Add SECURITY.md (#145)

Based on [credentialsd's
SECURITY.md](https://github.com/linux-credentials/credentialsd/blob/main/SECURITY.md).

Author: AlfioEmanueleFresta

SECURITY.md

@@ -0,0 +1,36 @@
+# libwebauthn Security Policy
+
+Since this project handles very sensitive data, we, the maintainers of
+libwebauthn, take security seriously. This policy outlines our intentions for
+addressing security issues and practices for security researchers investigating
+this project.
+
+## Submitting Vulnerability Reports
+
+If you have discovered a security vulnerability in this project, please report it
+to us privately via the process below.
+
+We use GitHub for private vulnerability disclosure. To report a vulnerability:
+
+1. Go to [Security > Advisories > New draft security advisory][new-advisory].
+2. Fill out the report and submit the draft.
+3. The maintainers will be privately notified about the advisory and get back to
+   you.
+
+[new-advisory]: https://github.com/linux-credentials/libwebauthn/security/advisories/new
+
+## Expected Response
+
+We aim to acknowledge the receipt of the report as soon as possible and will
+work with you. We seek to investigate issues within 30 days.
+
+If the issue is confirmed upon investigation, we will collaborate with you to
+remediate the vulnerability. Depending on the severity or developer
+availability, we may request more time to remediate the issue before
+public disclosure.
+
+# Supported Releases
+
+We only support the latest published release. We may backport patches when
+possible to help users running on distributions that package older versions of
+our software.