add SECURITY.md for responsible disclosure (re #25)