Please create a SECURITY.md or enable Private Vulnerability Reporting

Hello!
I'd like to ask that rav1d set up a SECURITY.md file with information on how to privately report vulnerabilities -- or enable [Private Vulnerability Reporting](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configuring-private-vulnerability-reporting-for-a-repository) via GitHub.

Thanks!!