Add Security Policy

[gabibguti]

Resolves #620

Here's a Security Policy suggestion.

The link for reporting vulnerabilities uses GitHub's Security Advisories report vulnerability feature, which is in beta. You would need to enable the feature in the repo for it to work.

How to enable private vulnerability reports

1. Open the repo's settings
2. Click on Code security & analysis
3. Click "Enable" for "Private vulnerability reporting (Beta)"

I've tried to keep the timelines for confirming vulnerability reports and fixing vulnerabilities as open as possible.

Let me know what do you think and if this seems reasonable for maintenance.

[edschofield]

Thanks Gabriela!