docs: add vulnerability disclosure policy

[anttiviljami]

Summary

• add a one-page SECURITY.md for reporting suspected vulnerabilities
• document report contents, coordinated disclosure, scope, and good-faith research expectations
• keep the policy voluntary and avoid promising a remediation SLA

This is documentation only; no runtime code changed.