chore(contributing): responsible disclosure

Ask to not use the issue tracker to disclose security problems
Great! Maybe instead of asking for a specific time make it: “. We will assess the issue as soon as possible on a best-effort basis and will give you an estimate for when we have a fix and release available for an eventual public disclosure”