Documenting how to file external non-VRP bugs.

This omission has resulted in some bugs not being credited properly in
release notes.

R=wfh@chromium.org

Change-Id: I27f9ff6605f3d037afdbeb8552e7f277436d9b7d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1868917
Auto-Submit: Adrian Taylor <adetaylor@chromium.org>
Reviewed-by: Will Harris <wfh@chromium.org>
Commit-Queue: Adrian Taylor <adetaylor@chromium.org>
Cr-Commit-Position: refs/heads/master@{#708764}

docs/security/security-labels.md

@@ -88,6 +88,10 @@ guidelines are as follows:
 * **reward-**{**topanel**, **unpaid**, **na**, **inprocess**, _#_}: Labels used
 in tracking bugs nominated for our [Vulnerability Reward
 Program](https://www.chromium.org/Home/chromium-security/vulnerability-rewards-program).
+If a bug is filed by a Google or Chromium user on behalf of an external party,
+but is not within scope for a vulnerability reward, nevertheless use **reward-na**
+to ensure that the report is still properly credited to the external reporter
+in the release notes.
 * **M-#**: Target milestone for the fix.
 * Component: For bugs filed as **Type-Bug-Security**, we also want to track
 which component(s) the bug is in.