Add a security policy

Could you add a security policy (for example, I submitted a PR: https://github.com/Activiti/Activiti/pull/5336)? That way, we can report vulnerabilities more securely and avoid exposing sensitive security details in public.