Define a security policy

Going to the Security page for Conduit ([link](https://github.com/ConduitIO/conduit/security)), we'll see that a security policy is missing.

I suggest we discuss if we need it (now or later) and implement if we decide to do so.