Add SECURITY.md

[annetill]

Please check if the PR fulfills these requirements

• [ ] The commit message follows our guidelines
• [ ] Tests for the changes have been added (for bug fixes / features)
• [ ] Docs have been added / updated (for bug fixes / features)

Does this PR already have an issue describing the problem?

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior (if this is a feature change)?

Does this PR introduce a breaking change or deprecate an API?

• [ ] The Breaking Change or Deprecated label has been added
• [ ] The migration guide has been updated in the github wiki (What changes might users need to make in their application due to this PR?)

Other information: