Update SECURITY.md

[security] Add a short security policy

Explains to people to send security-related bug reports to email instead of GitHub.