Add security policy with PVR instructions

Author: abcgco

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it
+responsibly through **GitHub Private Vulnerability Reporting (PVR)**.
+
+**To report**: Go to the [Security Advisories page](../../security/advisories/new)
+and submit a new advisory.
+
+**To enable PVR** (maintainers): Settings → Code security → Private vulnerability reporting → Enable.
+
+Please **do not** open public issues for security vulnerabilities.