security: Add bounty information (#103)

#### Problem

There's no bounty information about the program-metadata program, but
since it's been audited and deployed to mainnet, it is bounty-eligible.

#### Summary of changes

Copy over the bounty text from the token repo, and make changes as
necessary.

Author: joncinque

SECURITY.md

@@ -11,6 +11,8 @@ If you haven't done so already, please **enable two-factor auth** in your GitHub
 
 Expect a response as fast as possible in the advisory, typically within 72 hours.
 
+--
+
 If you do not receive a response in the advisory, send an email to
 <security@anza.xyz> with the full URL of the advisory you have created. DO NOT
 include attachments or provide detail sufficient for exploitation regarding the
@@ -20,3 +22,18 @@ If you do not receive a response from <security@anza.xyz> please followup with
 the team directly. You can do this in one of the `#Dev Tooling` channels of the
 [Solana Tech discord server](https://solana.com/discord), by pinging the admins
 in the channel and referencing the fact that you submitted a security problem.
+
+## Security Bug Bounties
+
+The Solana Foundation offer bounties for critical security issues. Please
+see the [Agave Security Bug
+Bounties](https://github.com/anza-xyz/agave/security/policy#security-bug-bounties)
+for details on classes of bugs and payment amounts.
+
+## Scope
+
+Only the `spl-program-metadata` program is included in the bounty scope, at
+[program](https://github.com/solana-program/program-metadata/tree/main/program).
+
+If you discover a critical security issue in an out-of-scope component, your finding
+may still be valuable.