Set up GitHub Security Policy (SECURITY.md)

[emkll]

Description

GitHub has recently introduced an easy way to specify a standard security policy for a given repository [1] . While all of this information is captured in our docs and README, we should copy or move this information to a standard location.

User Stories

As a security researcher, I would like to find a project's security policy in a standard location.

[1] https://help.github.com/en/articles/adding-a-security-policy-to-your-repository

[ageis]

This issue made me realize that I would also expect securedrop.org to have a .well-known/security.txt URI. https://securitytxt.org/