Resolves #199

To draw attention to the enabled "private vulnerability reporting" feature. Because unlike the SECURITY.md file which is prominently shown in a few places in the GitHub UI, the "private vulnerability reporting" feature can be difficult to find in case users are not aware that it exists.

Here are a few places where this SECURITY.md is shown:

• Tab on the main page
  
• Sidebar
  
• When using issue templates and the user creates a new issue (does not apply here, since this repository does not use issue templates)

Feel free to adjust the policy file as you like though, for example:

• mention things which are / are not considered vulnerabilities
  (maybe that is only needed if you get a lot of bogus reports)
• mention the time frame in which users can expect a result, e.g. in case you are busy with other projects, so that users know that it can take a few days