Add security documentation

[JelleZijlstra]

Closes #393.

[AlexWaygood]

Should this be in SECURITY.md? (The guy in the talk we're in just now said that's where security researchers expect to find this kind of stuff)

[JelleZijlstra]

@AlexWaygood I think we should also add SECURITY.md but I want to talk to someone (Seth?) to confirm the PSRT is OK with dealing with hypothetical security vulnerabilities in typing-extensions.

[AlexWaygood]

I think it would probably be fine to add an incomplete SECURITY.md file (with this information in it) and extend it later. But this is also fine!

[hauntsaninja]

Let's merge this. We should also think about doing https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability

[JelleZijlstra]

I enabled private vulnerability reporting and added a SECURITY.md pointing to it.