Update Chrome security bug reporting location

VRP reports via the Chromium template are deprecated.

Bug: b:518804997
Change-Id: I1699494689808e9950d94e3cf05115af3c9a0414
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/149710
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Auto-Submit: Alex Gough <ajgo@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

README.md

diff --git a/README.md b/README.md
index f5fb680..bb3866a 100644
--- a/README.md
+++ b/README.md
@@ -232,8 +232,11 @@
 
 ## Bugs
 
-PDFium uses this [bug tracker](https://crbug.com/pdfium/new), but for security
-bugs, please use
+PDFium uses this [bug tracker](https://crbug.com/pdfium/new).
+
+Report security bugs via [Google Bughunters (Chrome VRP)](https://bughunters.google.com/report/vrp).
+
+Project members and embedders can directly report security bugs using
 [Chromium's security bug template](https://crbug.com/new?component=1586257&noWizard=True&template=1922342).
 
 ## Contributing code