Add a coordinated vulnerability reporting policy

## Why

TorBot is a widely used security and OSINT crawler that processes untrusted crawl content, but the default branch does not currently provide a `SECURITY.md`. Public issues are not an appropriate place for researchers to disclose crawler, dependency, or data-handling vulnerabilities.

A clear private reporting path would make responsible disclosure safer and give maintainers a consistent way to triage reports.

## Proposed scope

- Add a `SECURITY.md` to the default branch.
- State which branches or releases currently receive security fixes.
- Make GitHub private vulnerability reporting the preferred channel, enabling it if needed.
- Define realistic, maintainer-approved acknowledgement and follow-up expectations.
- Explain how disclosure coordination will work.
- Warn reporters not to include credentials, private crawl targets, or sensitive crawl output in public issues.

## Acceptance criteria

- The repository exposes a clear private vulnerability-reporting path.
- Supported versions or branches are documented.
- Reporters know what information to include and what must stay out of public issues.
- Response expectations are realistic and maintainable.
- The policy is linked from an appropriate contributor-facing location.

## Reference

GitHub's repository security guidance recommends documenting supported versions and how vulnerabilities should be reported:

https://docs.github.com/en/code-security/getting-started/quickstart-for-securing-your-repository