add security policy

[mgravell]

Adds SECURITY.md using the Redis disclosure process; this makes sense since Marc is active inside Redis.

Checklist

• I fully and freely contribute this code in accordance with the project license (and am legally able to do so)
• I take responsibility for this contribution's quality and correctness, including any portions produced with AI assistance (see CONTRIBUTING.md).