Document security reporting contact

[Mirochill]

Summary

• add a SECURITY.md file that directs vulnerability reports away from public issues
• list the public author and maintainer contacts already present in package metadata
• link to the broader Hyper security guidance

Closes #290.

Validation

• git diff --check
• Not run: local hpack tests, tox, linters, packaging checks, or project tooling. This coordination workspace forbids local validation runs for third-party PRs; remote CI should provide executable validation.