Publish a security policy and private vulnerability-reporting path

[itsjling]

Problem

The repository has no SECURITY.md. Users have no stated way to report a vulnerability without making it public. GitHub's community profile and OpenSSF Scorecard both treat this as a missing trust signal.

Scope

• Enable GitHub private vulnerability reporting for the repository.
• Add SECURITY.md in a location GitHub and OpenSSF detect.
• State which release lines receive security fixes.
• Link to the repository's private vulnerability-reporting form.
• Give reporters the details to include and a realistic first-response target.
• Explain that ordinary bugs still belong in public GitHub issues.
• Avoid publishing a personal email address unless the maintainer asks for one.

Acceptance checks

• GitHub's Security policy link opens the new file.
• A signed-out visitor can find the private reporting path from the Security tab.
• The policy names supported versions, reporting steps, disclosure expectations, and the first-response target.
• The next OpenSSF Scorecard run detects the policy.
• corepack pnpm run docs:check, corepack pnpm run lint, and corepack pnpm test pass.