Add SECURITY.md

[jpopelka]

https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository