Update SECURITY.md: Add reporting information.