Update Security Policy for Vulnerability Reporting

[Malcolmnixon]

The SECURITY.md file should be updated to specify Vulnerability Reporting should be done using the security tab of the project, rather than trying to email the developers.