Add security policy

[bmtriet]

Summary

• add a SECURITY.md with private vulnerability reporting guidance
• ask reporters not to share vulnerability details in public issues, discussions, or PRs
• include the GitHub Private Vulnerability Reporting setup path for maintainers

Context

This is a small docs follow-up for #5217 so security reports have a clear private disclosure path.

Tests

• Documentation-only change
• git diff --check

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}