Allow administrators to provide public security contact information

Organizations can facilitate the responsible disclosure of security
issues by providing public contact information. The standard way to do
this is by using a [security.txt](https://securitytxt.org/) file.

This MR introduces this feature by adding:

- a new application setting (text, max 2048 chars)
- updated admin UI to configure this instance-level setting
- updated application setting API to configure the setting
- a new controller to render the content when present
- updated documentation describing the feature and how to use it

When present, the content will be available at
`https://YOUR_INSTANCE/.well-known/security.txt`.
Authentication is not required to view this file.

Changelog: added