Add an organization-wide security policy

[jeremy]

GitHub falls back to this repository for any ruby/* repo that has no SECURITY.md of its own, so
one file here gives every library in the organization a Report a vulnerability path.

Today most of them have none. I checked while looking for somewhere to send a report:

	private reporting	SECURITY.md
ruby/zlib	disabled	none (root, .github/, docs/)
ruby/syck	disabled	none
ruby/.github (the fallback)	—	none

So a reporter who lands on a default gem's repository sees no policy and no private reporting
button, and the reasonable guess is to open an issue — which is the one thing we do not want. This
is not hypothetical: these gems ship with Ruby, and ruby/zlib has already published
GHSA-g857-hhfv-j68w through
its security tab, so the outbound half is in use while the inbound half is missing.

What it says

Nothing new — it restates https://www.ruby-lang.org/en/security/:

• report through HackerOne or security@ruby-lang.org
• the PGP key at https://www.ruby-lang.org/security.asc
• do not open a public issue or pull request for a security problem
• valid problems are published after a fix is ready
• read the scope notes on the HackerOne page first
• website problems go to ruby/www.ruby-lang.org; gems that are not part of Ruby follow the
  RubyGems.org instructions

It also says explicitly that a library in its own repository here — ruby/openssl, ruby/psych —
is still Ruby, and should be reported through the same channels rather than in that library's issue
tracker. That is the case people get wrong.

Notes

• Short sentences and bullets throughout. Many readers of this file are not native English
  speakers, so I avoided idioms and phrasal verbs.
• A line near the top points Japanese readers to
  the Japanese version of the same page rather than to a
  translation of mine.
• Every link returns 200.
• Happy to adjust the wording, or to drop the per-repository paragraph if you would rather keep this
  to a plain restatement of the website.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.