Add a vulnerability report (not public)

[Corantin]

We have a security vulnerability policy: https://github.com/1Hive/quests/security/policy
For smart contracts, it redirects to 1hive bounty but for WebApp, it is a direct email to [email protected] (Gossman)
For now, it does the job but might be better to use something more people agnostic instead of only one email address