Add Security Policy Page

[rwinch]

I'd like to propose that we add a security policy page to make it easier to discover our security policy. It would also be valuable so that GitHub repositories can point to a single source under the Spring Teams control. We will be need to update our security policy to point to a vmware email address soon, so it would be nice to align these changes.

If this is acceptable, I would be happy to put together a pull request.