Add SECURITY.md file (#3201)

The policy for reporting security vulnerabilities is already
clearly stated, but some reporters may only look for it in a
"SECURITY.md" file.

This commit adds a SECURITY.md file, with the same contents
as the README file about reporting vulnerabilities.
That way, when someone is trying to report a vulnerability while
in a panic, we'll increase the odds that they find that information :-).

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>

SECURITY.md

@@ -0,0 +1,4 @@
+# Security
+
+Should you discover any security issues, please refer to sigstore's [security
+process](https://github.com/sigstore/.github/blob/main/SECURITY.md)