SECURITY.md with a disclosure process

[Jaydbrown]

There is no documented way to report a vulnerability or a malicious PR. Add SECURITY.md with contact + expectations.

[ZacLou]

I'd like to work on this issue. I have relevant experience with this tech stack and can deliver a clean, well-tested PR. I can submit within 1-2 days.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@ZacLou's PR #513 was approved and merged by @Jaydbrown.

🏆 @ZacLou: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (398 total points). Track your full progress on GrantFox.

👏 Great work, @ZacLou! Keep contributing to conduit-protocol.