Add security policy

[heart-ktf]

Summary

• add a root SECURITY.md with a documented vulnerability disclosure process
• direct reporters to GitHub private vulnerability reporting instead of public issues or pull requests
• include a fallback email address and the key details needed to triage a report

Why

Issue #84 asks for a clear responsible disclosure path so downstream users and security auditors can see how vulnerabilities should be reported without exposing them publicly.

This keeps the change minimal while still documenting where reports should go and what information helps with triage.

Closes #84