Provide a SECURITY.md file to explain how to report security issues

[marien-probesys]

Problem

If someone wants to report a security problem with Bileto, there is not so much guidance on how to do it properly. There is a small note in the CONTRIBUTING.md file, but that's about it. It is expected that projects have a SECURITY.md file to explain the details. It could be nice to explain the existing security measures as well (but maybe in a separate file?)