Merge pull request #312 from apache/pr-vuln-note

Add note about reporting a vuln in the PR template