Security policy and security@dask.org

Hi Folks,

Currently it looks like our security policy points towards tidelift. See https://github.com/dask/community/security/policy

Alternatively, we could create a security@dask.org alias and have some folks subscribed to it. I mention this mostly because I don't really know what TideLift does with this information, and because I think that there are a few people here who would be well suited to handle things (@jcrist @jacobtomlinson @quasiben others).

Thoughts?
-matt