Complete Security Defaults and Reporting Flow

[Copilot]

Closes #6

SECURITY.md contained conditional hedging that left the reporting path ambiguous, and docs/REPOSITORY_MANAGEMENT.md had no guidance on security feature configuration.

Changes

SECURITY.md

• Replace conditional reporting language with a definitive statement that private vulnerability reporting via GitHub is the supported channel
• Add a Security Features section covering private vulnerability reporting, secret scanning, push protection, and Dependabot
• Add a Limitations subsection documenting that consumers of the template are responsible for equivalent protections in derived repositories

docs/REPOSITORY_MANAGEMENT.md

• Add a Security Configuration section with a recommended feature baseline table
• Add a reminder to re-verify security settings after repository transfers, visibility changes, or organization migrations