updated readme part of security.yml

Use `anonymous` configuration instead of roles