Update security report submission guidelines

Clarified submission process for security reports.

SECURITY.md

@@ -8,5 +8,6 @@ If you believe you have found a security vulnerability with Nebula, please let
 us know right away. We will investigate all reports and do our best to quickly
 fix valid issues.
 
-You can submit your report on [HackerOne](https://hackerone.com/slack) and our
-security team will respond as soon as possible.
+For critical reports, if you are interested in a bug bounty: You can submit your report on [HackerOne](https://hackerone.com/slack).
+
+For other reports: You can [submit a report via GitHub](https://github.com/slackhq/nebula/security/advisories/new)