Add site builders' best practice to the "Security in Drupal 8" guide

Problem/Motivation

From #2758987: Anonymous users being registered and added to database, how Drupal is used by site builders and maintainers can be insecure. The existing Security in Drupal 8 guide section covers security of:

* manually written code
* automatically generated code

but nothing about how Drupal might be made more "locked down" from the pers

Proposed resolution

Add a page on "security best practice", at the very least linking to other existing guide pages e.g:

* User guide 4.5. Configuring User Account Settings
* Add a section on auditing role permissions: how to do that, and (linking if possible) what the administrator, anonymous and authenticated roles signify.
* Securing user #1

(The last item could maybe be migrated into the guide under "Security", although it's currently only for 6.x and 7.x.)

Remaining tasks

1. Add page with links as per above.
2. improve UID=1 documentation with details for 8.x (or at least check.)
3. Review configuration of a newly installed Drupal site for any other possibilities.
4. Decide what happens to this page in the light of the security advice yet to be migrated from pre-guide doc pages.

User interface changes

None.

API changes

None.

Data model changes

None.