Add security policy to installation instructions

It's not much, all RubyGems will do is making sure the signature matches the signing certificate, and that the signing certificate hasn’t expired.