DOC: Add SECURITY.md and enable private vulnerability reporting

Problem

The repository has no SECURITY.md and no documented private channel for reporting a vulnerability. For a package with thousands of forks, a JOSS publication, and wide use in teaching environments, a finder's only options today are a public issue (which discloses the problem before a fix exists) or an untracked email (no SLA, no audit trail).

GitHub Private Vulnerability Reporting is a one-click enablement in repository settings and gives reporters a private, tracked channel with a coordinated-disclosure workflow.

Acceptance criteria

• SECURITY.md at the repository root: supported versions, how to report, expected response time
• GitHub Private Vulnerability Reporting enabled
• SECURITY.md points at the private reporting channel rather than an email address
• Consistent with any QuantEcon org-level security policy; if one exists, reference it rather than restating it

From the July 2026 technical-debt audit (AI-assisted; claims verified against 28d4b3b on 2026-07-25).

Start by checking the repository root for an existing SECURITY.md and reviewing any QuantEcon organization-level security policy. Verify the GitHub private vulnerability reporting setting in repository settings, then document supported versions, reporting steps, and response time while referencing the organization policy where appropriate. Done means the file is present and points to the enabled private channel.