[Bug] Location of SECURITY.md in step 4

[chriswblake]

Summary

In step 4, if the user manually creates the SECURITY.md file in a different location, the grading check fails.

From the docs, the file is supported in 3 locations: ./, ./docs/, and ./github/

https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository

Note: this is not a problem if they follow the guide that instructions them to use the web interface. That will default to using the ./ folder.