[CRA] Create SECURITY.md

What does this MR do and why?

Starting September 11, 2026, the EU Cyber Resilience Act (CRA) requires Open Source Software (OSS) Stewards to report actively exploited vulnerabilities and severe security incidents impacting digital products sold in the EU market (to the extent they are involved in product development).

This MR publish a SECURITY.md notice with a short CRA stewardship statement.

Related reference(s)

#4095

• Understanding the EU Cyber Resilience Act (CRA) (LFEL1001) - Linux Foundation - Education
• LF-Supported Projects and CRA Readiness one page overview.