Add a security policy

[pnacht]

GitHub recommends that projects have a Security Policy (SECURITY.md). This is a simple document that explains how the project wishes to receive and handle responsible disclosure of potential vulnerabilities.

There are a few ways to receive such disclosures:

• have an email or website available to receive such reports; and/or
• use GitHub's private vulnerability reporting feature (in beta)

If you're interested in GitHub's feature, it must be activated for the repository:

1. Open the repo's settings
2. Click on Code security & analysis
3. Click "Enable" for "Private vulnerability reporting (Beta)"

I'll send a PR with a draft policy along with this issue.

[pnacht]

Hey, let me know if this is something that the project would be interested in. Otherwise, feel free to close!