SECURITY.md: add to all layers

SECURITY.md is a standard way to include information on how to
report a vulnerability in a project. Add it to all layers that
can be considered a separate work and could be copied by users.

Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com>