docs: add security escalation policy (#5466)

Author: UlisesGascon

SECURITY.md

@@ -5,3 +5,14 @@
 To report a security vulnerability, please use the
 [Tidelift security contact](https://tidelift.com/security).
 Tidelift will coordinate the fix and disclosure.
+
+## Escalation
+
+If you do not receive an acknowledgement of your report 
+within 6 business days, or if you cannot find a private 
+security contact for the project, you may escalate to the 
+OpenJS Foundation CNA at `[email protected]`.
+
+If the project acknowledges your report but does not 
+provide any further response or engagement within 14 days, 
+escalation is also appropriate.