adjust the response time for vulnerability report

[bjohansebas]

In our security policy, it states that we will get in touch within 48 hours after a vulnerability has been reported. I believe this is a short timeframe, considering that reports can be made over the weekend, and I don’t think many of us as maintainers would want to be available on a weekend. Perhaps we should consider extending the response time for such reports or improving the message to specify business days.