Set up a project security policy

[cary-ilm]

Copy SECURITY.md from OpenEXR or one of the other ASWF projects, and delete whatever doesn't apply to your project. This cover several of the OpenSSF badge requirements, like the policy, vulnerability reporting, and expectations.

Other related steps to take:

1. Set up [email protected] that forwards to your technical steering committee. The LF can help configure this.
2. On the "Code security & analysis" page of your GitHub repo settings, enable private vulnerability reporting.