Add OSS Scanner build and security contact

Keeps the OSS Scanner build and threat model in the ERPNext repository.