Add security disclosure info to README/CONTRIBUTING docs