README.md: add SECURITY