Create security policy and include email from contribute.md

[zidingz]

While trying to report a security issue, found contact email and instruction in contribute.md

FYI - the security tab on a repo allows you to create a security policy (security.md), which bug disclosers look for on a repo. The instructions in contribute.md are perfect - so chucking them onto a security policy would be a great quality of life improvement. Thanks!

[pablobm]

Thank you for the heads up. I have created a PR with a security policy, so we should have one soon.