[2.1+] add Responsible Disclosure guidelines to README / to project

[panique]

As publishing potential bugs on the GitHub issues board might also attract criminals / attackers it might be a good idea to handle serious security bugs differently, in a semi-hidden way, only available for some people.

Not sure how to do this, maybe with at first with direct reports to a certain email address before writing a ticket here.