Add description on how 3rd-party dependency security issues are handled (#61956)

* Add description on how 3rd-party dependency security issues are handled

Our users seem to not have a good idea on how 3rd-party dependencies
are handled and how they should approach it and open issues that are
often closed and we need to explain them what is expected of them -
they have pretty unrealistic expecations that every single CVE in
every single dependency will be addressed when they open an issue.

This description clarifies how handling of 3rd-party dependency
issues should be done and what are responsibilities and expectations
of the users, and what they can expect from the maintainers.

This will help us to direct such users to this process without
spending our time on explaining it over and over again.

Apply suggestions from code review

Co-authored-by: Jens Scheffler <95105677+jscheffl@users.noreply.github.com>

* Update airflow-core/docs/security/vulnerabilities-in-3rd-party-dependencies.rst

Co-authored-by: Shahar Epstein <60007259+shahar1@users.noreply.github.com>

* Update airflow-core/docs/security/vulnerabilities-in-3rd-party-dependencies.rst

Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

---------

Co-authored-by: Jens Scheffler <95105677+jscheffl@users.noreply.github.com>
Co-authored-by: Shahar Epstein <60007259+shahar1@users.noreply.github.com>
Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

docker-stack-docs/index.rst

@@ -95,6 +95,8 @@ are also images published from branches but they are used mainly for development
 See `Airflow Git Branching <https://github.com/apache/airflow/blob/main/contributing-docs/10_working_with_git.rst#airflow-git-branches>`_
 for details.
 
+.. _fixing-image-at-release-time:
+
 Fixing images at release time
 =============================