add security issue from 3.5.4 release to SECURITY.md

[jeffpaul]

Description of the Change

This PR adds the security issue from 3.5.2-3.5.3 to our Security Policy. We may want to consider updating the Supported Versions section as I'm not 100% certain that's accurate, will defer to @brandwaffle on that.

Alternate Designs

n/a

Benefits

Ensures we properly document known issues.

Possible Drawbacks

None identified.

Verification Process

Manually verified by the GitHub web UI.

Checklist:

• I have read the CONTRIBUTING document.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my change.
• All new and existing tests passed.

Applicable Issues

n/a

Changelog Entry

### Added
- CSRF Nonce Bypass issue to `Known Vulnerabilities` section of [ElasticPress' Security Policy](https://github.com/10up/ElasticPress/security/policy) (props @jeffpaul).