security policy: Specifically mention not reporting via Matrix

The Matrix room is just as public as the old IRC channel, which makes it
just as unsuitable for reporting security vulnerabilities as IRC.

Signed-off-by: Simon McVittie <smcv@collabora.com>