support GitHub security advisory links

GitHub is adding the ability to handle security reports and fixes privately in their UI. Instead of creating an issue, the reporter creates a security advisory, and then GitHub allows discussing and handles creating a private fork with private PRs until the advisory is published publicly. It would be nice to be able to reference the advisory page just like we can reference issue pages.

:ghsa:`ab1c-2def-g34h`

would become:

https://github.com/my/project/security/advisories/GHSA-ab1c-2def-g34h