Adding security.md for security reporting

[rz1027]

Hello, may you add a SECURITY.md file for security disclosures ? Rather than opening this in a public issue or pr.

Thanks