Add SECURITY.md

[jameslamb]

Description

Contributes to rapidsai/build-planning#281

• adds a SECURITY.md describing how to report security vulnerabilities

Notes for Reviewers

Why not just set this org-wide?

An org-wide default is set at https://github.com/rapidsai/.github/blob/main/SECURITY.md, but adding an actual file in each repo offers a few benefits:

• ensures security policy travels with the repo to forks, clones, mirrors, etc.
• allows per-repo governance over the security policy (via PR review, CODEOWNERS, etc.)

This can be admin-merged

I'll stop CI intentionally after pre-commit runs, to save CI time and resources.

[ncclementi]

Thank you @jameslamb