update security policy - encourage advisories

They are private, allow collaboration, and makes publishing and CVEs
very easy to do.

SECURITY.md

@@ -2,4 +2,9 @@
 
 ## Reporting a Vulnerability
 
-Please inform me by writing an email to the @icloud.com email used in my commits. Thank you.
+Please feel free to [draft a GitHub advisory](https://github.com/Byron/gitoxide/security/advisories/new), and I will work with you to disclose and or resolve the issue
+responsibly.
+
+If this doesn't seem like the right approach or there are questions, please feel free to reach out to the @icloud.com email used in my commits. 
+
+Thank you.