Create SECURITY.md

[stuartjohnpage]

Add a security policy and who to tell if a vulnerability is found!