docs(security): add SECURITY.md and a private reporting channel

[eaitbrahim]

Closes #279

keel holds exchange API credentials and places live orders. Once strangers read the source,
someone will eventually find a way to make it misbehave — and until now the only options were
a public issue (disclosing to everyone simultaneously) or nothing.

What

• SECURITY.md at the repo root:
  • Private channel: GitHub private vulnerability reporting — the Report a
    vulnerability button under the Security tab. Enabled in repo settings (verified:
    gh api .../private-vulnerability-reporting → {"enabled":true}); the file alone gives
    no channel, per the issue's note.
  • Scope: the defining class — a rail that can be bypassed is a security issue, not
    merely a bug (allowlist, caps, drawdown breakers, kill-switch), credential/secret
    exposure, and corruption of the attestation/audit trail.
  • Out of scope: strategy performance and market losses, a user's own key handling, the
    exchange's own outages.
  • Response expectations, honestly sized for one maintainer: acknowledge within 3 days,
    severity + plan within 14, coordinated disclosure, credit by default.
• tests/test_security_policy.py (written first, red, then green): pins the channel, the
  day-count commitment, the rail-bypass scope line, and the out-of-scope list. The
  GitHub-side setting is outside the tree and was verified against the live repo instead.

Gates (rebased on main after #297): pytest 2782 passed / 1 skipped, ruff check clean,
mypy clean.