Add policy document for using GitHub actions in workflows

[bjhargrave]

Closes https://github.com/instructlab/dev-docs/issues/12

[bjhargrave]

One thing, would it be worth discussing "secrets"?

I think a doc on secret management for the github organization is also a good idea. There could be a list of secrets, their purpose, how they are managed, who is responsible for rotation if needed, etc.