Add `SECURITY.md` (security policy, threat model, etc)

[JeanChristopheMorinPerso]

As part of the OpenSSF Best Practices badges, we need to create a SECURITY.md file at the root of the repository to document a couple of things:

• Security policy (how to report vulnerabilities, our response time, etc)
• Threat model
• And potentially other things.

Requirements:

• https://www.bestpractices.dev/en/projects/8389#vulnerability_report_process
• https://www.bestpractices.dev/en/projects/8389#vulnerability_report_private
• https://www.bestpractices.dev/en/projects/8389#vulnerability_report_response
• https://www.bestpractices.dev/en/projects/8389?criteria_level=1#documentation_security
• https://www.bestpractices.dev/en/projects/8389?criteria_level=1#vulnerability_response_process
• https://www.bestpractices.dev/en/projects/8389?criteria_level=1#assurance_case