Update SECURITY.md to current org-standard policy

## Problem
The current SECURITY.md is out of date and doesn't match the policy now used across IntersectMBO repos (e.g. reporting process / contact / disclosure steps).

## Proposed change
Sync SECURITY.md with the org-standard version maintained in the open-source-office repo:
https://github.com/IntersectMBO/Open-Source-Office/blob/main/security-policy-documents/v1.1/SECURITY.md

## Notes
Happy to open a PR if a maintainer confirms this is wanted. Will base it on the reference above unless this repo needs anything specific kept.