Add a SECURITY.md file to the project

See https://blog.liftsecurity.io/2013/06/02/security-md-improved-security-disclosure