pump/SECURITY.md

pipe streams together and close all of them if one of them closes

## Security contact information

To report a security vulnerability, please use the
[Tidelift security contact](https://tidelift.com/security).
Tidelift will coordinate the fix and disclosure.