Add SECURITY.md to current org-standard policy

## Problem
There is no current SECURITY.md

## Proposed change
Sync SECURITY.md with the org-standard version maintained in the open-source-office repo:
https://github.com/IntersectMBO/Open-Source-Office/blob/main/security-policy-documents/v1.1/SECURITY.md

## Notes
Happy to open a PR if a maintainer confirms this is wanted. Will base it on the reference above unless this repo needs anything specific kept.