add required SECURITY.md file for OSSF Scorecard compliance