Docs: add SECURITY.rst

[aryansk]

Problem

Following recent discussion, we should better publicise our security policy (which is currently to use GitHub's Security Advisories or to email the maintainer).

There is no SECURITY.rst (or SECURITY.md) in the repository, so contributors have no clear place to find the policy.

Fixes #13063

Change

Adds SECURITY.rst at the repository root:

• Reporting via GitHub Security Advisories <https://github.com/sphinx-doc/sphinx/security/advisories/new>_ (preferred) or email as per CONTRIBUTING.rst
• Supported versions (latest + previous minor when feasible)
• Disclosure policy and link to GitHub docs

Single-file docs-only addition.

Why this approach

SECURITY.rst is the conventional location GitHub surfaces via the Security tab (“View security policy”). Using reStructuredText matches the rest of the repo (README.rst, CONTRIBUTING.rst, etc.) and keeps the policy discoverable both on GitHub and in the docs.

Testing

command: git diff --check
result: clean

command: rst2html SECURITY.rst (via docutils)
result: no errors

Documentation and release impact

• User-facing documentation added
• Changelog — docs-only

Review notes

• Follow-up: none
• Security: this is the security policy

AI disclosure

Muse Spark assisted in drafting the policy; all changes reviewed and tested manually. Co-authored-by trailers included for Pair Extraordinaire.

Co-authored-by: Muse Spark muse-spark@users.noreply.github.com
Co-authored-by: Aryan Singh K 70511529+aryansk@users.noreply.github.com