Add SECURITY.md (closes #613)