add SECURITY.md

[Cmdv]

Description

This fixes #1855

Checklist

• Commit sequence broadly makes sense
• Commits have useful messages
• New tests are added if needed and existing tests are updated
• Any changes are noted in the changelog
• Code is formatted with fourmolu on version 0.10.1.0 (which can be run with scripts/fourmolize.sh)
• Self-reviewed the diff

Migrations

• The pr causes a breaking change of type a,b or c
• If there is a breaking change, the pr includes a database migration and/or a fix process for old values, so that upgrade is possible
• Resyncing and running the migrations provided will result in the same database semantically

If there is a breaking change, especially a big one, please add a justification here. Please elaborate
more what the migration achieves, what it cannot achieve or why a migration is not possible.