[496425] Security policy should not reference specific technologies

At present, Bugzilla is the only place where vulnerability issues can be
reported, so we're leaving specific references to Bugzilla in the
document. The use of the word "bug", however, has been changed to
"issue".