security: consider implementing security policy and enable Dependabot Auto PR

[gaukas]

As of 01/26/2024, there are 4 outstanding security alerts with one of them being rated as High severity. We require a much responsive model in terms of patching security vulnerabilities.

I would recommend adding a security policy clarifying what do we (plan to) provide and enabling automated PR by Dependabot helping patching the vulns.

[erikziyunchi]

wasmtime related upgrades always require some changes in the code as they sometimes change their APIs 🤕.

[gaukas]

And I see this issue has been addressed in #26 and following dependabot-related PRs, now closing as completed!