Add docs for security issue and MR associations

We've accumulated a bit of terminology around security release issues and merge requests and how they all relate to each other, so a diagram might be helpful.