Add SECURITY.md file

The other day, Rodrigo and me noticed that WPCS does not have a published security policy (via a `SECURITY.md` file).

This commit intends to add such a file, which should help inform security researchers how to disclose any findings they may have.

Author: jrfnl

.github/SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported Versions
+
+The latest minor version of the `3.x` release series is supported for security updates.
+
+## Reporting a Vulnerability
+
+The WordPressCS team takes security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
+
+**Please do not report or discuss security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Issues can be reported privately to the maintainers by opening a [Security vulnerability report].
+
+> [!CAUTION]
+> Please take note that while the WordPress organisation has a HackerOne program, the WordPress Coding Standards software is not covered by this program.
+> Full details of the WordPress Security Policy and the list of covered projects and infrastructure can be found on [HackerOne][WordPress HackerOne].
+
+### Preferences
+
+* Please provide detailed reports with reproducible steps and a clearly defined impact.
+* Include the version number of the vulnerable package in your report.
+* Fixes are most welcome.
+    A private PR can be created from the security report to work on and discuss the patch.
+
+[Security vulnerability report]: https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/new
+[WordPress HackerOne]:           https://hackerone.com/wordpress