Create the security.md file

[hsiung]

For the evalution of jsonata-java library, OpenSSF Scorecards is relying on the security policy file security.md.
If this file is missing, the score is 0, the same score as if the library would be extremely vulnerable.
This is a pity for such a good software.
Adding this file would greatly increase the positive perception of jsonata-java.

[aeberhart]

thanks for pointing this out @hsiung