Add SECURITY.md file (WordPress#2766)

* Add `SECURITY.md` file

The other day, Rodrigo and me noticed that WPCS does not have a published security policy (via a `SECURITY.md` file).

This commit intends to add such a file, which should help inform security researchers how to disclose any findings they may have.

The file is placed in the `.github` directory. This will allow for it to be recognized correctly by GitHub, while not cluttering up the project root directory.

Ref: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy

---------

Co-authored-by: jrfnl <jrfnl@users.noreply.github.com>
Co-authored-by: Denis Žoljom <dingo-d@users.noreply.github.com>

Author: 2 people

.github/SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+The latest minor version of the `3.x` release series is supported for security updates.
+
+## Reporting a Vulnerability
+
+The WordPressCS team takes security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
+
+**Please do not report or discuss security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Issues can be reported privately to the maintainers by opening a [Security vulnerability report].
+
+> [!CAUTION]
+> Please take note that while the WordPress organisation has a HackerOne program, the WordPress Coding Standards software is not covered by this program.
+> Full details of the WordPress Security Policy and the list of covered projects and infrastructure can be found on [HackerOne][WordPress HackerOne].
+
+### Preferences
+
+* Please provide detailed reports with reproducible steps and a clearly defined impact.
+* Include the version number of the vulnerable package in your report.
+* Fixes are most welcome.
+
+A private PR can be created from the security report to work on and discuss the patch.
+
+[Security vulnerability report]: https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/new
+[WordPress HackerOne]:           https://hackerone.com/wordpress