Cover Security in the standard files

I propose that the default files cover Security. Be it as text in the CONTRIBUTING.md, or via a SECURITY.md file. Ideally both, with the SECURITY.md going into the org's template directory.

Like the CoC, the security file will need some kind of unusual contact address.

Start by reviewing the existing CONTRIBUTING.md, Code of Conduct, and the organization's template directory to understand the standard-file conventions. Confirm the appropriate unusual contact address with maintainers, then document security guidance in CONTRIBUTING.md and add the corresponding SECURITY.md template; done means both proposed locations are covered.

Written by the indexing model from the issue text.