Add secure channel for security incident reporting

[johnnyshields]

After move to SAML-toolkits, the readme now says:

## Security Guidelines

If you believe you have discovered a security vulnerability in this gem, please report it
as an issue

This is not ideal. There should be a private channel for vulnerability disclosure, e.g. an email would be fine.