Create a security policy (SECURITY.md)

[toddysm]

Summary

Add a repository security policy at SECURITY.md describing how to report vulnerabilities in the CSSC framework and its published artifacts.

Motivation

The repo currently has no SECURITY.md. GitHub surfaces this file in the Security tab and the "Report a vulnerability" flow, and it is the natural target for the security-policy image annotation proposed in #134. Without it, security reporters have no documented, discoverable channel.

Scope — write the policy into SECURITY.md

The file should cover at least:

• Supported versions — which releases receive security fixes.
• Reporting a vulnerability — the preferred private channel (GitHub private security advisories) and what to include in a report.
• Response expectations — acknowledgement and triage timeline; coordinated disclosure preference.
• Scope — what is in/out of scope (e.g. the framework workflows/actions, the CSSC Dashboard app images, published Helm charts).

Acceptance criteria

• SECURITY.md exists at the repo root with the sections above.
• It is visible under the repo Security tab / "Report a vulnerability" flow.

Related

• Prerequisite for Build: add security-policy and vulnerability-reporting annotations #134 (security-policy image annotation needs a URL to point at).