Establish security policy

[Farhad-Shabani]

Background

We should establish a security policy (add security.md) prior to the first stable release. So, if someone finds a vulnerability, they should know how to report it and what are the procedures.
We can use the generic guidelines within the Cosmos security repo.