Provide a Github-sanctioned way to (indicate where to) report vulnerabilities

[regalialong]

Following the VR Overlay RCE, it's probably a good idea to give a way for people who find vulnerabilities to be able to report them to maintainers. I've skimmed over the repo and don't see instructions on how to do so.

Some more obvious suggestions are:

• Add a SECURITY.md

  • Github embeds this on the Security tab, which gives a standardized way to indicate where to report security issues and how they end up being handled:
    

• Enable private vulnerability reporting

  • This enables a process for security researchers to privately report vulnerabilities
    
  • An obvious advantage is that this can also tie back to [Feature Request] In-App Security Advisories #859, where advisories can be published and shown in-app per the Github API