Consistent with other SDKs (typescript, python, csharp), add a SECURITY.md file citing Anthropic's overarching security policy. This is not specialized to the Go SDK, but seems better than not having a policy.