.github: add security policy (SECURITY.md)

This file is interpreted by Github.

Signed-off-by: Richard Alpe <richard@bit42.se>

.github/SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Infix, please use GitHub's built-in
+[Report a Vulnerability](https://github.com/kernelkit/infix/security/advisories/new)
+feature for a private and secure disclosure.
+
+When reporting, include:
+
+- A clear description of the vulnerability.
+- Steps to reproduce the issue.
+- Potential impact of the vulnerability.
+
+## Supported Versions
+
+We provide security updates only for the main branch.
+
+Individual support contracts are provided by _Wires_. See
+[Support](https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md)
+for more information.
+
+## Acknowledgments
+
+We appreciate the efforts of the security community to help improve the security
+of Infix. Thank you for your responsible disclosure.