[9.18] Move security-related information to SECURITY.md

Backport of !8257 (merged)

Merge request reports