chore(security): add security.md

SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+Until this crate reaches 1.0, only the most recent release will be certainly be supported for
+security updates, but an effort will be made to backport critical patches when possible.
+
+## Reporting a Vulnerability
+
+To report a vulnerability, email [hi@jbr.me](mailto:hi@jbr.me).
+
+Feel free to [draft a GitHub Security Advisory](https://github.com/jbr/routefinder/security/advisories/new) in addition to the above.
+
+> [!IMPORTANT]
+> Please do not _exclusively_ file a GitHub security advisory without also reaching out on another channel. GitHub's notifications for draft security advisories are inadequate and too easily missed.