docker,docs: resync the root Dockerfile and add a security policy (#907)

.github/workflows/python.yml

@@ -23,6 +23,9 @@ on:
       - '.github/**'
       - 'data/**'
       - 'tests/**'
+      # tests/test_dockerfile_sync.py compares these two files.
+      - 'Dockerfile'
+      - 'web/Dockerfile'
 
 permissions:
   contents: read