docs: create security and permissions file (#13748)

Co-authored-by: Rhys Arkins <rhys@arkins.net>

docs/usage/security-and-permissions.md

+# Security and Permissions
+
+## Global Permissions
+
+| Permission        | Renovate hosted app |  Forking Renovate  | Why                                                           |
+| ----------------- | :-----------------: | :----------------: | ------------------------------------------------------------- |
+| Dependabot alerts |       `read`        |       `read`       | Create vulnerability fix PRs                                  |
+| Administration    |       `read`        |       `read`       | Read branch protections and to be able to assign teams to PRs |
+| Metadata          |       `read`        |       `read`       | Mandatory for all apps                                        |
+| Checks            | `read` and `write`  |   not applicable   | Read and write status checks                                  |
+| Code              | `read` and `write`  |       `read`       | Read for repository content and write for creating branches   |
+| Commit statuses   | `read` and `write`  | `read` and `write` | Read and write commit statuses for Renovate PRs               |
+| Issues            | `read` and `write`  | `read` and `write` | Create dependency dashboard or Config Warning issues          |
+| Pull Requests     | `read` and `write`  | `read` and `write` | Create update PRs                                             |
+| Workflows         | `read` and `write`  |   not applicable   | Explicit permission needed in order to update workflows       |
+
+## User permissions
+
+Renovate can also request users's permission to the following resources.
+These permissions will be requested and authorized on an individual-user basis.
+
+| Permission | Renovate hosted app | Forking Renovate | Why                                                      |
+| ---------- | :-----------------: | :--------------: | -------------------------------------------------------- |
+| email      |       `read`        |       N/A        | Per-user consent requested if logging into App dashboard |