docs(security): add organization security policy

[benjiwagner]

Summary

• Add the organization-wide security policy so every public repository points researchers to private vulnerability reporting.

Context

Private vulnerability reporting was enabled on all public repositories on 2026-07-20, but only the product repository carried a SECURITY.md; this default covers the rest.

Validation

• Markdown only; no executable changes. Rendered locally.

Impact and rollback

GitHub serves this file as the default security policy for repositories without their own. Roll back by reverting the squash commit.