docs(SECURITY): sync security policy

Author: caugner

.github/CODEOWNERS

@@ -64,3 +64,4 @@
 # If another reviewer is specified, update the PAT token or auto-merge will cease to be automatic.
 /package.json @mdn/engineering @mdn-bot
 /yarn.lock    @mdn/engineering @mdn-bot
+/SECURITY.md @mdn/engineering

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you've discovered a security issue, please report it through the form linked
+below, which will create a secure, private ticket.
+https://bugzilla.mozilla.org/form.web.bounty
+
+MDN may be eligible for
+[Mozilla's Security Bug Bounty Program](https://www.mozilla.org/en-US/security/bug-bounty/).
+You can find more information about the bounty program in the
+[Mozilla Web Bug Bounty FAQ](https://www.mozilla.org/en-US/security/bug-bounty/faq-webapp/).
+You can use the above form even if you are not interested in a bounty reward.