Add SECURITY.md policy

Add a SECURITY.md file to document how users should report security vulnerabilities.

This should include:
- How to report security issues (email/private disclosure)
- Expected response time
- Supported versions
- Security update policy

Reference: https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository