Add security policy

[shadowspawn]

I am going through the process of "lifting" this project on Tidelift.
NB: There is not any current income!
You can apply as a lifter now too @abetomo , or leave it until later.

I copied the security policy from Commander, but have a question about it and Tidelift.

Tidelift has some simple options to describe the "security maintenance plan". I came up with six month support for older versions, which is not covered by their "common" plans. We could perhaps switch to support for one previous major version. This would usually be about a year since we do major versions to drop unsupported versions of node. (And the previous version of Commander we are supporting would usually include one unsupported version of node.)

The "one previous version" is nice and simple to describe, which I like. Alone it doesn't give any fixed minimum or maximum duration for support of the old version which I see as a small downside (say if we released a new major version every week!).

Shall I have a go at rewording so our policy covers "previous version" without a maximum time?

[abetomo]

I agree.
I too think "one previous version" is better.

[shadowspawn]

Trying very simple: no example, no table. I think this is fairly clear unless the reader does not know what a major version number is.

[abetomo]

👍