Adding SECURITY.md

GitHub added [`SECURITY.md` earlier this year]( https://github.blog/changelog/2019-05-23-security-policy/ ). It would be good to figure out if this is something we want to include in our repos, if so which ones, and what should be contained in it.

As one possibility, we might include a security policy in the docs here and have repos merely link to it (so as to cutdown churn and avoid staleness). There might be other good options though.