Add SECURITY.md so that GitHub can display it

The content matches our support article "How can I report a security
vulnerability?", with tweaks to make it clearer what is or isn't in
scope.

https://support.signal.org/hc/en-us/articles/360007320791-How-can-I-report-a-security-vulnerability-

SECURITY.md

@@ -0,0 +1,9 @@
+If you've found a security vulnerability in Signal, please report it via email to
+<[email protected]>.
+
+Please only use this address to report security flaws in the Signal application (including this
+repository). For questions, support, or feature requests concerning the app, please submit a
+[support request][] or join the [unofficial community forum][].
+
+[support request]: https://support.signal.org/hc/requests/new
+[unofficial community forum]: https://community.signalusers.org/