docs(security): add SECURITY.md vulnerability disclosure policy

[adamy]

Adds a vulnerability disclosure policy (SECURITY.md), shown by GitHub on the repo's Security tab.

Policy highlights

• Private reporting: GitHub Security Advisories (private vulnerability reporting now enabled on the repo) or the Object IT contact form — no public issues for vulnerabilities.
• Response targets: acknowledge within 3 business days, initial assessment within 14 days; fix timeline by severity.
• Scope: the three NuGet packages + embedded widget, explicitly including DoS vulnerabilities in BotWire code (ReDoS in PII/prompt-injection guards, rate-limiter bypass).
• Out of scope: third-party deps (tracked via Dependabot), samples-only issues (unless they demonstrate an insecure recommended pattern), volumetric DoS against hosting services.
• AI-specific section: guards are best-effort; deployer responsibilities; guard bypasses are reportable.

Repo settings enabled alongside (not in this diff)

• Dependabot vulnerability alerts
• Dependabot security updates (auto-PRs for vulnerable deps)
• Private vulnerability reporting

🤖 Generated with Claude Code