Add a GH SECURITY.md page to framework and plugins branches

After reading this security-discuss@community.apache.org thread: I decided to add, for now, a simple SECURITY.md, like in Apache Commons. We could get further and add a page like in Apache Groovy

There is though a small difference with Commons and Groovy, the pages to consider are
https://github.com/apache/ofbiz-framework/security/policy
https://github.com/apache/ofbiz-plugins/security/policy

I guess this is because we use Dependabot and CodeQL for JavaScript (only).