Call out the security reporting info in the CONTRIBUTING file