SECURITY.md doesn't exist for community-plugins, create an initial basic document describing where/how users would make reports today.

Based on conversations in the Community Plugins SIG, this will use the GitHub security advisories and processes.