Add SECURITY.md (#16224)

## Summary

Resolves #16206.

The file was copied almost verbatim from
[uv's](https://github.com/astral-sh/uv/blob/929e7c3ad96ff6b14aeb60527e6a4526ed24ec43/SECURITY.md),
with the first section removed.

## Test Plan

None.

SECURITY.md

@@ -0,0 +1,15 @@
+# Security policy
+
+## Reporting a vulnerability
+
+If you have found a possible vulnerability, please email `security at astral dot sh`.
+
+## Bug bounties
+
+While we sincerely appreciate and encourage reports of suspected security problems, please note that
+Astral does not currently run any bug bounty programs.
+
+## Vulnerability disclosures
+
+Critical vulnerabilities will be disclosed via GitHub's
+[security advisory](https://github.com/astral-sh/ruff/security) system.