Add SECURITY.md.

Inspired by Adam Baldwin's JSConf 2013 "Builders and Breakers" talk.
http://blog.liftsecurity.io/post/52010883123/security-md