docs: sync README accuracy (tests, tools, security reporting)

[j-cadena-g]

Summary

• Update the tests badge from 85 → 109 to match the current suite.
• Correct the Security module tool count from 14 → 18 (table now sums to the documented 117).
• Point vulnerability reporting at SECURITY.md instead of a public GitHub issue.

Test plan

• Confirmed npm test reports 109 passing
• Confirmed src/tools/security.ts registers 18 tools; category table sums to 117
• Security section matches private-disclosure guidance in SECURITY.md