Defines Security Policy as recommended by Github

Github recommends adding SECURITY.md into the top folder of a project
https://help.github.com/en/articles/adding-a-security-policy-to-your-repository

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Supported Versions
+
+Please vist the [Releases](https://struts.apache.org/releases.html#prior-releases) page to see full information about each version 
+and what potential vulnerability it can have:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.5.20  | :white_check_mark: |
+| 2.3.37  | :x:                |
+
+## Reporting New Security Issues with thr Apache Struts
+
+([original](https://struts.apache.org/security.html))
+
+The Apache Struts project takes a very active stance in eliminating security problems
+and denial of service attacks against applications using the Apache Struts framework.
+
+**We strongly encourage folks to report such security problems to our private security mailing list first,
+before disclosing them in a public forum**.
+
+We cannot accept regular bug reports or other queries at this address, we ask that you use our
+[issue tracker (JIRA)](https://issues.apache.org/jira/browse/WW) for those.
+
+```
+All mail sent to this address that does not relate to security problems in the Apache Struts source code will be ignored
+```
+
+Note that all networked servers are subject to denial of service attacks, and we cannot promise magic
+workarounds to generic problems (such as a client streaming lots of data to your server, or re-requesting
+the same URL repeatedly). In general our philosophy is to avoid any attacks which can cause the server
+to consume resources in a non-linear relationship to the size of inputs.
+
+The mailing address is: [security@struts.apache.org](mailto:security@struts.apache.org)
+
+[General network server security tips](http://httpd.apache.org/docs/trunk/misc/security_tips.html)
+
+[The Apache Security Team](http://www.apache.org/security/)