add vulnerability reporting steps

[jranson]

Summary

This change adds a SECURITY.md file that outlines the process for reporting security vulnerabilities, and points to it in the existing CONTRIBUTING.md.

GitHub's Security and quality section sources SECURITY.md, and this file is required to enable private vulnerability reporting outside of the normal Issue / Pull Request process.

Related Issues

N/A

Testing

Tests pass on local worktree.

Checklist

• Tests pass (N/A, no code change)
• Documentation updated (if applicable)

[tescalada]

Should the security reporting go in this repo or in the parent? I have open several issues in the parent for the docs that are not yet completed like the SECURITY.md EarthSpark/.github#1

My understanding is that having them in the .github repo sets them as the default for all repos in the org. Same for the issue templates and all that. I think the License is the only thing that intentionally doesn't propagate.

[jranson]

You can put the security file in the org repo. The main drawback to that is while it will populate all org projects' Security tabs, it will not be included in cloned copies of repo codebases alongside the license, contributing, etc. That could make it harder to find if someone is looking at an individual repo or a local clone.