SECURITY.md: add instruction for disabling Conscrypt's default TrustManager (grpc#6962)

Author: voidzcy

SECURITY.md

@@ -232,9 +232,14 @@ import java.security.Security;
 ...
 
 // Somewhere in main()
-Security.insertProviderAt(Conscrypt.newProvider(), 1);
+Security.insertProviderAt(
+    Conscrypt.newProviderBuilder().provideTrustManager(false).build(), 1);
 ```
 
+Note: according to [Conscrypt Implementation Notes](https://github.com/google/conscrypt/blob/2.4.0/IMPLEMENTATION_NOTES.md#hostname-verification),
+its default `HostnameVerifier` on OpenJDK always fails. This can be worked 
+around by disabling its default `TrustManager` implementation as shown above.
+
 ### TLS with Jetty ALPN
 
 **Please do not use Jetty ALPN**