Routine fixes for (harmless) CVEs

Boring update of several dependencies with CVE announcements that don't really affect ActiveWorkflow.

Added SECURITY.md "boilerplate" with information on how to report security issues.