Repository lacks a security policy

[AaronFeickert]

The repository does not have a security policy to inform researchers and developers about how the project wishes to receive information about security vulnerabilities.

Fortunately, GitHub supports a standard way to add such a policy to the repository.

It would be useful to add this!