Merge pull request #254 from alex/contributing

Call out the security reporting info in the CONTRIBUTING file