add SECURITY.md, pointing to GitHub PVR (#405)

Author: vszakats

SECURITY.md

@@ -0,0 +1,12 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+-->
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you have found or just suspect a security problem somewhere in trurl,
+report it via <https://github.com/curl/trurl/security>.
+
+We treat security issues with confidentiality until controlled and disclosed responsibly.