docs: Create SECURITY.md with responsible disclosure policy

[Faithy5]

Closes #212

Changes

• Add SECURITY.md with supported versions, private reporting instructions, response SLA (48h acknowledgment, 7d for critical), and coordinated disclosure policy.

Acceptance Criteria

• SECURITY.md exists
• Includes reporting instructions
• Includes supported version policy
• Includes response SLA

[Xhristin3]

Clean SECURITY.md @Faithy5! Covers all the bases from the issue — supported versions table, private reporting via GitHub Advisories, severity-graded SLA (48h ack / 7d critical resolution), and a coordinated disclosure policy. Short and professional. Closes #212. ✅