docs: add security policy

[WilliamBergamin]

Summary

• Adds a SECURITY.md to .github/ with vulnerability reporting instructions, threat model, and disclosure policy
• Directs reporters to the Slack HackerOne bug bounty program
• Defines in-scope vulnerabilities (signature bypass, token leakage, DoS, auth bypass) and out-of-scope issues

closes: #2608

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e81dbd6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.86%. Comparing base (b12a62f) to head (e81dbd6).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2609   +/-   ##
=======================================
  Coverage   88.86%   88.86%           
=======================================
  Files          62       62           
  Lines       10230    10230           
  Branches      450      450           
=======================================
  Hits         9091     9091           
  Misses       1117     1117           
  Partials       22       22           

Flag	Coverage Δ
cli-hooks	88.86% <ø> (ø)
cli-test	88.86% <ø> (ø)
logger	88.86% <ø> (ø)
oauth	88.86% <ø> (ø)
socket-mode	88.86% <ø> (ø)
web-api	88.86% <ø> (ø)
webhook	88.86% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zimeg]

🎁 Super thank you @WilliamBergamin for these pages!