Add SECURITY.md

Establish a private channel for vulnerability reports: email to
ken@bonsai.com encrypted to the listed GPG key.  The policy states a
72-hour acknowledgment window, asks for coordinated disclosure, and
lists the contact key with import instructions.

SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+To report a security vulnerability, please send an email to:
+
+- `ken@bonsai.com`
+
+Please encrypt your report to the key listed below.
+
+You will receive an acknowledgment within 72 hours.
+
+## Disclosure
+
+Please report privately and allow a fix to be prepared and released
+before public discussion.  Reporters are credited in the published
+advisory unless they prefer otherwise.
+
+## Contact Keys
+
+The following keys may be used to encrypt reports and other sensitive
+communication:
+
+| Name         | Email            | Fingerprint                                        |
+|--------------|------------------|----------------------------------------------------|
+| Ken Sedgwick | `ken@bonsai.com` | 4695 E5B8 F781 BF85 4326  9639 BBFC E515 8602 5550 |
+
+You can import a key by running the following command with that
+fingerprint:
+`gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys "<fingerprint>"`.
+Ensure that you put quotes around fingerprints containing spaces.