Add a SECURITY.md doc (#3505)

Adds a small doc with security info.

b/263903968
b/263900290

SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported Versions
+
+Currently supported stable Cobalt versions are.
+
+| Version | Release status   | Supported          |
+| ------- | -----------------|------------------- |
+| 25.lts  | upcoming release | :white_check_mark: |
+| 24.lts  | last stable      | :white_check_mark: |
+| 23.lts  | maintenance      | :white_check_mark: |
+| 22.lts  | EOL              | :no_entry:         |
+| < 21.lts| no support       | :x:                |
+
+
+## Model
+
+Although Cobalt is built to process web content similar to browsers,
+it is not a web browser. Our security model assumes _only trusted content
+processing_.
+
+## Reporting a Vulnerability
+
+Please use [https://developers.google.com/youtube/cobalt](https://developers.google.com/youtube/cobalt/docs/communication) as an overall guide where to report issues.
+
+Critical security vulnerabilities should be reported via [email protected].