Add SECURITY.md before public release

[kanejamison]

Problem

No security policy exists; before the gem goes public there is no documented channel for private vulnerability disclosure.

Proposed solution

Add SECURITY.md with:

• Supported versions table
• Private disclosure channel (GitHub security advisories and/or maintainer email)
• A short statement of the gem's security model: public controllers are read-only by design; authentication/authorization for content writes is the host application's responsibility (and the Avo admin must be locked down by the host app).

Acceptance criteria

• SECURITY.md present and linked from README.
• GitHub shows the policy under the repo's Security tab.

[kanejamison]

closed by #77