Add SECURITY.md to document security deprecation

[willhallonline]

You could put deprecation warnings in older images and stop updating them if you wanted, but I would definitely have some sort of policy explaining what you support. We do this with a SECURITY.md file.