OpenZeppelin/canton-contracts: SECURITY.md

# Security policy ## Security response OpenZeppelin publishes source code and versioned DAR artifacts, but does not operate or control adopter participant nodes. When a vulnerability is identified, OpenZeppelin will investigate affected package IDs, publish a corrected release where technically poss