Create Security Policy

[bensternthal]

As part of project graduation, every OpenJS project must have a security policy.

Minimal guidelines can be found here and project owners are encouraged to use GitHub's native security policy features that can be found under the "security" tab.