Create SECURITY.md

[cyberqueenmeg]

I am a security researcher on HackerOne and when I was testing some vulnerabilities according to the HackerOne guidelines for Slack, I came here and noticed that Nebula does not have a Security Policy. I am aware that this is not a Tier 0 vulnerability but I wanted to contribute a draft of one anyways to help the security of Nebula. Thank you for your consideration.

[CLAassistant]

All committers have signed the CLA.

[hlovdal]

Notice there is also this pull request.