* chore: add SECURITY.md, security reporting process
Signed-off-by: Dorian Johnson <2020@dorianj.net>

* security.md: link to the announcements mailing list
Signed-off-by: Dorian Johnson <2020@dorianj.net>

* README: add link to security reporting process
Signed-off-by: Dorian Johnson <2020@dorianj.net>