Add security policy

[sosthene-nitrokey]

This PR adds a security policy, documenting where to report any found security vulnerability.