Add security policy

[neild]

This repository doesn't have a SECURITY.md. I've poked around in README.md and CONTRIBUTING.md, and I can't seem to find a path for reporting security issues in them.

Doesn't have to be anything complicated, but it'd be nice to have a documented email address or something other than the public issue tracker to send vulnerability reports to.