Add SECURITY.md

[kojiromike]

This is a public tool that creates users and resets credentials in OpenEMR. It needs a published vulnerability-reporting address so external users know how to report security issues responsibly.