chore: add security policy

[dashpole]

Copy of GoogleCloudPlatform/opentelemetry-operations-go#772 for the js repo.

[conventional-commit-lint-gcf]

🤖 I detect that the PR title and the commit message differ and there's only one commit. To use the PR title for the commit history, you can use Github's automerge feature with squashing, or use automerge label. Good luck human!

-- conventional-commit-lint bot
https://conventionalcommits.org/

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (b2723a3) 97.72% compared to head (fe64654) 97.72%.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #662   +/-   ##
=======================================
  Coverage   97.72%   97.72%           
=======================================
  Files          18       18           
  Lines         703      703           
  Branches      136      136           
=======================================
  Hits          687      687           
  Misses         16       16           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.