docs: add security policy

[bmtriet]

Summary

• add SECURITY.md with the existing private GitHub Security Advisory reporting path
• ask reporters not to disclose vulnerabilities in public issues, discussions, or PRs
• add concise guidance on what to include in private reports and how disclosure/security updates are handled

Closes #36692.

Verification

• Confirmed SECURITY.md and .github/SECURITY.md were not present via GitHub Contents API
• Confirmed the repo already exposes the private advisory contact link
• Ran git diff --check

This is documentation only. No credentials, account access, private data, or vulnerability details are included.