security: add security policy

[wesleyylg928392839]

A SECURITY.md file has been added with recommendations for responsible vulnerability disclosure. This document describes where to report and what information to include to simplify the security reporting process.

---

Note

Low Risk
Documentation-only change with no impact on runtime behavior or security controls.

Overview
Adds a SECURITY.md security policy documenting how to privately report vulnerabilities, what details to include, and the expected disclosure process.

^{Written by Cursor Bugbot for commit 6e458a5. This will update automatically on new commits. Configure here.}