Add severity level to SECURITY.md

[wendycwong]

We just starting to track our security problems in SECURITY.md. Unfortunately, the severity level was not included (HIGH, MEDIUM, LOW). Need to add it there.

[hannah-tillman]

@hannah-tillman can see severity levels here: #16442 (comment)