Update SECURITY.md

The info provided in SECURITY.md (which is linked at the bottom of README.md) is very outdated. It recommends checking the release info (but h2o does not publish releases anymore) and to read h2o.examp1e.net. The latter then links to the really interesting page, which I found out about only now: https://github.com/h2o/h2o/security/advisories, containing also today's advisory concerning "HTTP/2 bomb".