add SECURITY.md

[jmckenna]

• describes how to report vulnerabilities
• describes what versions are supported
• more info: https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository