[security] Create VEX documents for our releases

[malice00]

As stated here, we should start creating and releasing VEX documents.
The biggest question is how/where to host these and/or otherwise get them out to our customers. Awareness probably needs to be created as well.

[prabhu]

Maybe publish as part of the docs so there is a http URL to download the JSON directly? Below is how one of the Apache projects is doing it.

https://github.com/apache/solr-site/blob/main/vex-input.json