we need to create security.md

The current community lacks a clear security policy setting; it is recommended to add a SECURITY.md
SECURITY.md file considering the [report vulnerability through security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability), which is a new GitHub feature