docs(security): state response-time SLA in the security issue template

[Fury03]

Closes #1091

Problem

.github/ISSUE_TEMPLATE/security.md told reporters how to file, but not how long they would wait for a reply. SECURITY.md already had a Response Timeline section (48h / 7d / 30d) — the template just never surfaced it, so a researcher deciding between reporting and waiting had to go find it.

Changes

.github/ISSUE_TEMPLATE/security.md — a "What to expect" section above the report fields, restating the three targets verbatim from SECURITY.md and linking to SECURITY.md#response-timeline, plus what to do if 48 hours pass with no reply.

SECURITY.md — two edits to keep the documents from contradicting each other:

• Under Response Timeline, a note that the targets apply to every reporting channel (private advisories and non-sensitive public issues filed with the template), that the template restates the same timeline, and that changing one means changing the other. That last line is the actual guard against future drift.
• In Contact, the "open a public issue" bullet now links the template.

Cross-check

The three bullets are byte-identical between the two files, including capitalisation:

- **Initial Response**: Within 48 hours of receiving your report
- **Status Update**: Within 7 days with our assessment and planned timeline
- **Resolution**: We aim to resolve critical vulnerabilities within 30 days

No timeline numbers were invented or changed — the template adopts what SECURITY.md already committed to.

Out of scope

No bug bounty program, no SLA-tracking automation.

[Fury03]

Note on the failing CI checks

The red checks here are pre-existing on main and unrelated to this PR.

main's own CI run — 30494417974, the merge commit for #1130, which is the base of this branch — fails with the identical set:

Job	Cause on main
Backend CI	~20 tsc errors, mostly IndexerStateRow.createdAt missing in src/lib/indexer-state.ts, plus soroban-indexer.service.ts, soroban-event-worker.ts, admin-rate-limiter.middleware.ts, tests/stream.test.ts, tests/stream.validator.test.ts
Frontend CI	eslint parsing errors in frontend/src/components/dashboard/dashboard-view.tsx, frontend/src/hooks/useIncomingStreams.test.ts, frontend/src/lib/dashboard.ts
Soroban Contracts CI	cargo fmt diffs at contracts/stream_contract/src/test.rs:433 and :2709
Backend Docker Image CI	fails during the backend build, same tsc errors
Backend npm test	14 failing tests across 6 files: indexer-state, soroban-event-worker, integration/admin-metrics, integration/stream-actions, integration/stream-lifecycle, integration/streams/withdraw

This PR changes only Markdown, so it cannot affect any of those jobs — a docs edit does not change cargo fmt output or TypeScript types.

Happy to open a separate PR fixing the main breakage if that would be useful, but it would touch files well outside this issue's scope, so I have kept it out of here.

[ogazboiz]

the three timeline bullets match SECURITY.md's response timeline exactly, no numbers invented, and thanks for the sharp CI triage comment on the red window. merging. non-blocking: the relative SECURITY.md link will not resolve inside filed issue bodies, an absolute URL in a follow-up would be nice. if you want to keep contributing, join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0