Add a security policy

[0xevn]

To give people instructions for reporting security vulnerabilities in our project, we should add a SECURITY.md file to repository root