chore: add security policy - #188

This is a simple security.md yet provides enough information for users to submit vulnerability findings. I'm just wondering if we should adopt a similar structure as the one in the multipass repo.

Even though we want to keep it simple, I would suggest adding the title "Security Policy" and the header "Reporting a Vulnerability" before the proposed contents.

This is a simple security.md yet provides enough information for users to submit vulnerability findings. I'm just wondering if we should adopt a similar structure as the one in the multipass repo.

Even though we want to keep it simple, I would suggest adding the title "Security Policy" and the header "Reporting a Vulnerability" before the proposed contents.

This is actually the template that is being mandated by Security and already adopted by many repos.

As for the Title and subtitle, they feel a bit redundant in the absence of other sections but I don't mind adding them (done).