Create a `SECURITY.md` file

[di]

In https://github.com/pypa/pip/pull/11140 some documentation was added to resolve https://github.com/pypa/pip/issues/11037, but I think this repo should also have a SECURITY.md file describing the security policy in a way that is more accessible to GitHub users, available here: https://github.com/pypa/pip/security/policy, and checking one of the items off of this list: https://github.com/pypa/pip/security/