Add Vulnerability Reporting Policy

This commit updates SECURITY.md to inform contributors and users of
the Vulnerability Reporting Policy for the Time Graph.

Signed-off-by: Hoang Thuan Pham <hoang.pham@calian.ca>

SECURITY.md

@@ -13,4 +13,9 @@ This shall be determined once releases start, the resulting table shall look lik
 
 ## Reporting a Vulnerability
 
-Report a vulnerability by opening an issue.
+If you think or suspect that you have discovered a new security vulnerability in this project, please __do not__ disclose it on GitHub, e.g. in an issue, a PR, or a discussion. Any such disclosure will be removed/deleted on sight, to promote orderly disclosure, as per the [Eclipse Foundation Vulnerability Reporting Policy][policy].
+
+Instead, please report any potential vulnerability to the Eclipse Foundation [Security Team][security]. Make sure to provide a concise description of the issue, a CWE, and other supporting information.
+
+[policy]: https://www.eclipse.org/security/policy.php
+[security]: https://www.eclipse.org/security