docs(security): add section for tools

Author: jsjoeio

docs/SECURITY.md

@@ -1,12 +1,30 @@
 # Security Policy
 
+The code-server team (and Coder, the organization) care a lot about keeping the project secure and safe for end-users.
+
+## Tools
+
+We use a combination of tools to help us stay up-to-date and fix vulnerabilities.
+
+- [dependabot](https://dependabot.com/)
+  - Automatically keeps code-server up-to-date by updating dependencies in response to security alerts.
+  - See alerts [here](https://github.com/cdr/code-server/security/dependabot).
+- code-scanning
+  - [CodeQL](https://securitylab.github.com/tools/codeql/)
+    - Semantic code analysis engine that runs on a [regular schedule](../.github/workflows/codeql-analysis.yml#L9-L11).
+  - [trivy](https://github.com/aquasecurity/trivy)
+    - Comprehensive vulnterability scanner that runs on PRs into the default branch and scans both our [Docker image](../.github/workflows/ci.yaml#L410-L439)) and [repository code](../.github/workflows/ci.yaml#L444-L466).
+  - See alerts [here](https://github.com/cdr/code-server/security/code-scanning).
+- [`audit-ci`](https://github.com/IBM/audit-ci)
+  - Audits npm and Yarn dependencies [in CI](../.github/workflows/ci.yaml#L46-L48) on PRs into the default branch and fails CI if [moderate or higher vulnerabilities](../ci/dev/audit.sh#L7-L9) are present.
+
 ## Supported Versions
 
 Coder sponsors development and maintenance of the code-server project. We will fix security issues within 90 days of receiving a report, and publish the fix in a subsequent release. The code-server project does not provide backports or patch releases for security issues at this time.
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 3.9.3   | :white_check_mark: |
+| Version                                               | Supported          |
+| ----------------------------------------------------- | ------------------ |
+| [Latest](https://github.com/cdr/code-server/releases) | :white_check_mark: |
 
 ## Reporting a Vulnerability