Document examples of best practices for different development archetypes

Document good examples of security best practices in different development archetypes, such as:

- application/platform/tooling/package?
- front-end/back-end
- small scale/medium/large scale?
- build process/no build?
- different attack vector surface types?

This thought came out of a security collab space conversation today with @rginn @ljharb @bensternthal @shusak and myself. 