Enable security reports

[sudo-bmitch]

Should image-spec enable the security reports feature recently launched by GitHub? I'm leaning towards yes, but wanted to get some buy in before clicking the button.

https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository