GOV: change security reporting to use tidelift

Author: tacaswell

SECURITY.md

@@ -17,15 +17,12 @@ versions.
 
 ## Reporting a Vulnerability
 
-If you have found a security vulnerability, in order to keep it confidential,
-please do not report an issue on GitHub.
 
-Please email us details of the vulnerability at [email protected];
-include a description and proof-of-concept that is [short and
-self-contained](http://www.sscce.org/).
+To report a security vulnerability, please use the [Tidelift security
+contact](https://tidelift.com/security).  Tidelift will coordinate the fix and
+disclosure.
 
-You should expect a response within a week of your email. Depending on the
-severity of the issue, this may require some time to draft an immediate bugfix
-release. Less severe issues may be held until the next release.
+If you have found a security vulnerability, in order to keep it confidential,
+please do not report an issue on GitHub.
 
 We do not award bounties for security vulnerabilities.