docs: explicitly define contract scope in SECURITY.md

[s6pa1rta3n-lab]

Summary

Resolves #122.

Updates SECURITY.md's Scope section to explicitly classify all crates under contracts/:

• In scope: Production contracts (contracts/tholos and contracts/tholos-v2).
• Out of scope: Third-party dependencies (soroban-sdk, the Stellar network itself), and the integration examples (contracts/demo-consumer and contracts/asserter-consumer), which exist to validate integration patterns and are not intended for production use on their own.

Payout Stipulations Checklist

• Read issue [Chore] SECURITY.md doesn't mention asserter-consumer's scope #122 requirements and scope
• Clarify contracts/asserter-consumer's scope alongside contracts/demo-consumer
• Explicitly list in-scope production contracts (contracts/tholos and contracts/tholos-v2)
• Pass all workspace tests and clippy checks

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC

[collinsezedike]

@s6pa1rta3n-lab This PR isn't tied to an assignment on #122. You haven't commented there to ask for it, and it hasn't been assigned to you. Please comment on #122 first and wait for assignment before this gets reviewed.

[collinsezedike]

@s6pa1rta3n-lab Closing — #122 is assigned to a different contributor (Iker2522), not opened without assignment on your part in the first place, per the earlier comment on this PR.