docs: add security disclosure policy

[ccai40359-wq]

Summary

• Add a repository security policy with scope, CVSS-based severity definitions, safe harbor, and coordinated disclosure timeline
• Add .well-known/security.txt for automated security policy discovery
• Clarify that recognition is possible but monetary rewards are not guaranteed unless an official program states otherwise

Verification

• python3 content assertions for required SECURITY.md and security.txt fields
• git diff --cached --check
• added-line security scan: security_findings_count 0
• independent reviewer passed with no blocking concerns

Closes #46