Read the releases the security policy said did not exist

[iderex]

Refs #365

Finishes: #365

What was wrong

git show 009b843:SECURITY.md | sed -n '194,203p'
## Supported versions

There is no released version:

    gh release list --limit 5      # no output
    git ls-remote --tags origin    # no output

Until there is one, the default branch is the only thing there is to fix, and
no version support window is offered because no version exists to offer one
for.

Both commands produce output:

gh release list --limit 5
0.1.1.0-stable  Latest  0.1.1.0-stable  2026-09-04T11:17:20Z
0.1.0.0-stable          0.1.0.0-stable  2026-09-03T10:26:03Z

git ls-remote --tags origin | head -4
92e9c856d98845f5216d9e605d5afcb4e2968b56        refs/tags/0.1.0.0-stable
dcf53dad20d368275606f2ddcafca449f7409f4e        refs/tags/0.1.0.0-stable^{}
749285953b47c28a352ba4efbf97fa72e164421d        refs/tags/0.1.1.0-stable
14557477dd8429ffa1170f22d8a844290a44ec72        refs/tags/0.1.1.0-stable^{}

So every sentence in that section rested on an absence the tracker contradicts,
in the file a person reports a vulnerability from, in the section they read to
find out whether what they are holding is in scope. The plugin is installable
from the catalogue at the address the readme gives, so a reporter with a finding
against a released archive was told the version they hold does not exist. The
most likely next act is that they do not report it.

What it says now

Both releases, with the commands that read them, and a fix landing on the
default branch.

The support window is the half to read carefully, and it is the half this change
is most careful about. It stays absent. What changes is that its absence is a
decision nobody has taken rather than something entailed by there being no
version, and the section says so in those words: no window is offered, none is
implied, nothing says a fix will be carried back to a released version and
nothing says it will not, and the section will name the supported versions on
the day that is decided. The negative disclosure stays negative and does not
become an assurance in either direction.

The correction is marked in the text rather than made silently, in the shape this
repository already uses, so a reader who saw the old sentence can see that it
moved.

What holds it, which is nothing, and why that is stated in the section

No leg is added and none is claimed. The suite runs with no network, so nothing
here re-derives a release listing; that is exactly how the sentence being
replaced survived two releases without reddening anything, and the section now
says it rather than leaving a reader to assume the block is checked.

The fenced list SecurityPolicyTests reads is at the top of this file and is
untouched.

VSTEST_CONNECTION_TIMEOUT=300 DOTNET_CLI_UI_LANGUAGE=en dotnet test Jellyfin.Plugin.MetadataSync.sln --nologo
Failed: 0, Passed: 1696

per target, over both server lines, before the change and after it.

What this does not decide

Which versions get a support window. That is a decision and this change does not
take it, which #365 says in its own body.

Reading

No second reader looked at this. The commands above are the evidence in place of
one.