Update SECURITY.md for reporting a vulnerability

[wkoot]

The security vulnerability page displays SECURITY.md - https://github.com/ICTU/quality-time/security We should update the "Reporting a Vulnerability" segment to list https://github.com/ICTU/quality-time/security/advisories/new instead of sending an email