Add SECURITY.md

[masutaka]

Also enable Private vulnerability reporting.