A Bonus-Malus Framework for Cyber Risk Insurance and Optimal Cybersecurity Provisioning