chore: add SECURITY.md to all repositories

[jflowers]

Context

The governance scan (2026-08-21) found SECURITY.md present in only 1 of 10 repositories (replicator).

Action

Add a SECURITY.md file to this repo (.github). GitHub automatically uses the org-level .github repo's SECURITY.md as the default for all repos that don't have their own.

Repos currently missing SECURITY.md (8):

• .github (this repo -- org-wide default)
• gaze
• dewey
• unbound-force
• website
• homebrew-tap
• containerfile
• intake-kit

Acceptance Criteria

• SECURITY.md exists in .github repo (org-wide default)
• All repos show a security policy in the next governance scan