Set up a project security policy

[cary-ilm]

Copy SECURITY.md from OpenEXR or one of the other ASWF projects, keep whatever's relevant and delete whatever doesn't apply to your project. This covers several of the OpenSSF badge requirements, like the policy and expectations.

Other ASWF projects support a [email protected] that forwards to your technical steering committee, but this is somewhat redundant with GitHub's private vulnerability reporting, which you've already configured.