docs: Add note on reporting viruses or trojans on Windows

assets/chezmoi.io/docs/developer-guide/security.md

@@ -4,6 +4,16 @@
 
 Only the most recent version of chezmoi is supported with security updates.
 
+## Virus scanner false positives
+
+Virus scanning software, especially on Windows machines, occasionally report
+viruses or trojans in the chezmoi binary. This is almost certainly a false
+positive.
+
+For more information see [Why does my virus-scanning software think my Go
+distribution or compiled binary is infected?](https://go.dev/doc/faq#virus) in
+the Go FAQ.
+
 ## Reporting a vulnerability
 
 Please report vulnerabilities by [opening a GitHub