Add SECURITY.md to enable private vulnerability reporting

[lihnucs]

What this PR adds

A SECURITY.md file at the repository root, which:

• Tells reporters which versions receive security fixes
• Provides a clear, private channel for submitting vulnerability reports
• Sets response time expectations (14-day acknowledgement, 90-day disclosure window)
• Defines what is in and out of scope

Why

Without a SECURITY.md, security reporters have no official channel and
may resort to opening public issues, which exposes vulnerability details
before a fix is available.

Once this file is merged, GitHub will display a "Report a vulnerability"
button on the Security tab, giving reporters a confidential submission path
directly to the maintainers.

One follow-up step for maintainers

After merging, please enable Private vulnerability reporting under:

Settings → Code security and analysis → Private vulnerability reporting → Enable

This activates the "Report a vulnerability" button that the SECURITY.md
references. Without this step the button will not appear.

Notes

• The [maintainer email] placeholder on line 22 should be replaced with
  a real contact address before or after merging
• The supported versions table may need updating as new releases are made