Add SECURITY.md file - #10254

Prompted by a recent request, here is a draft security policy. I don't think we need to make it too complicated:

• Use the Github Security reporting tool (which we just enabled) for security issues
• Numba is a compiler that generates arbitrary code, so you need to trust all the inputs.