overriding security.md in repos if existing there already? No! 👍

Unless created inside a repo the central version in .github repo will be shown. The same goes for other policy files as well.