docs: SECURITY.md says how to report a vulnerability (#65)

SECURITY.md asks for vulnerabilities to be reported privately, through GitHub's private vulnerability reporting or by email to karl-einarb@outlook.com.

docs/development.md: the "Pull requests" heading is now "How changes land". The section covers squash merges, PR titles and branch protection, not how to send one.

Reviewed-on: #65
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>

SECURITY.md

@@ -0,0 +1,11 @@
+# Security
+
+Please report a vulnerability privately, not in a public issue:
+
+- on GitHub, with **Report a vulnerability** under the
+  [Security tab](https://github.com/karleinarb/lazysecrets/security), or
+- by email to karl-einarb@outlook.com.
+
+Say what's affected, how to reproduce it and the version
+(`lazysecrets --version`). Fixes go into the next release, and only the
+latest release gets them.