Document the security best practice

[FeynmanZhou]

We need to document the security best practice to tell users how to use Notation in a security posture. The security best practice and considerations include but are not limited to:

• Security considerations for developing and using Notation plugins. The plugins should be documented such that the security trade-offs are clear to plugin developers and users.
• Security considerations for using container registries, such as using --insecure flag when Notation interacts with an HTTP registry
• Notation authentication (Credential Store and environment variable)
• What should users do against the threat model doc: create notation threat model specifications#242
  ···

This is a big topic. We can iterate on the content creation.

[FeynmanZhou]

Notation is installed on the user's file system. The ongoing threat model highlights that a compromise of the file system in which Notation is deployed might be a major security risk. As such, users should be aware of the risks associated with slacking on the security of the file system in their usage. We need to remind users to make sure their file system is secure with strict permission in the installation guide.

[zr-msft]

Fixed by #228 #219 #270 #223