Create SECURITY.md
Hi @zidingz, thanks for your contribution.

However I am closing it because it is a duplicate of a previous PR:
 -  #2958


To let the repository confirm feedback@huggingface.co as its security contact.