Add security policy

[mondeja]

Hi! I've found a security problem in the action and I want to send a patch, but that would make the patch public and possible attackers could compromise repositories that are using lychee-action.

So to start with the process, I'm opening this to create a SECURITY.md document that will enable Security policy in the repository Security tab.

To send the patch in a private fork, that will not be public, I need that someone with write access to the settings enable Private vulnerability reporting. The other Security advisories can be enabled also without publishing all reports as each report can be marked as public or not later.

Note that there is another approach that maybe you want to take. You can create a unique global SECURITY.md file that will apply for each repository on your organization by creating a lycheeverse/.github repository and putting the SECURITY.md file there.

[mre]

Done. Also enabled Private vulnerability reporting.

[mre]

Fixed the link. I think you wanted it to point to https://github.com/lycheeverse/lychee-action/security/advisories/new. (The security/ was missing.)