Add Security Policy and enable Private Security Reporting

[Tristan F.]

Hello! I found a security concern in this repository and would like to safely disclose it. If a security policy (to define scope and contact) and private security reporting (for safe disclosure) can be added, it would mean I can safely disclose this advisory and would be greatly appreciated.

[Kitson Kelly]

Private security reporting has been enabled for the repo.