Enact security policy

[Zeitsperre]

Pull Request Checklist:

• This PR addresses an already opened issue (for bug fixes / features)
  • This PR addresses goals in [OpenSSF] Complete OpenSSF Best Practices recommendations #1181
• Tests for the changes have been added (for bug fixes / features)
  • (If applicable) Documentation has been added / updated (for bug fixes / features)
• CHANGES.rst has been updated (with summary of main changes)
  • Link to issue (:issue:number) and pull request (:pull:number) has been added

What kind of change does this PR introduce?

• Adds a security policy

Does this PR introduce a breaking change?

No.

Other information:

This Pull Request is waiting on the following:

• Creation of a mail account/redirect specific for the GitHub Organization Admins and major project leads.
  • Done (Office email group redirect for [email protected])
• Make this email redirect group public.
• Creation of a PGP key pair for encrypted emails (following email creation).
• CHANGES.rst should be updated with this information as an announcement.

This information will be reusable for all projects falling under Ouranosinc.

[github-actions]

Note
It appears that this Pull Request modifies the main.yml workflow.

On inspection, the XCLIM_TESTDATA_BRANCH environment variable is set to the most recent tag (v2023.12.14).

No further action is required.

[Zeitsperre]

@huard @aulemahal

I just want to double-check the PGP key before merging, but otherwise this is ready for review.

[aulemahal]

Héhé I have some difficulties in imagining a "security vulnerability" stemming from xclim (and not from a dependency), but eh. Better safe than sorry.

[Zeitsperre]

Same. The way I see this is we now have a security process in place that can serve all of our projects. I can imagine that with PAVICS-related projects, server-side security is a much harder thing to secure. You never know when an issue could come up there.

This also nearly completes the OpenSSF certification, so that's also pretty cool.

[coveralls]

coverage: 90.299%. remained the same
when pulling 28a52d3 on security-policy
into b8446c4 on master.