SECURITY.md: add security disclosure document

[hlef]

This is a draft of the security disclosure document.

A few items that we need to discuss:

• Before merging this, we should create the security disclosure page mentioned here.
• Do we mention sending swag in this document? Let's take a decision.
• Is the name and location of this file correct? Do we want to have it here or in the main tree? Do we want to have a file in the main tree that points to this?

Signed-off-by: Hugo Lefeuvre [email protected]