Private vulnerability reporting is enabled for the repository

## Summary

Enable GitHub's private vulnerability reporting so the repository exposes a
private disclosure path and a populated Security tab.

## Motivation

#241 ("SECURITY.md added") carries the scope item "Provide private contact path
(security advisories)" and the acceptance criterion "GitHub security tab
populated". Neither is satisfiable from a pull request — private vulnerability
reporting is a repository setting, not a file. At present:

```console
$ gh api repos/:owner/:repo/private-vulnerability-reporting
{"enabled":false}
```

So a merged SECURITY.md on its own would leave #241 with criteria it cannot
check off from the diff. Splitting the setting change out keeps #241 scoped to
the committed file.

## Scope

- Enable private vulnerability reporting (Settings → Code security, or
`gh api --method PUT repos/:owner/:repo/private-vulnerability-reporting`).
- Confirm the Security tab offers a "Report a vulnerability" entry point.
- Keep SECURITY.md's reporting instructions consistent with the enabled
mechanism (coordinate with #241).

## Acceptance criteria

- [ ] `gh api repos/:owner/:repo/private-vulnerability-reporting` returns
`{"enabled":true}`.
- [ ] The repository Security tab offers a private "Report a vulnerability"
path.
- [ ] SECURITY.md's reporting section names that path.

## Additional context

Split out of #241 rather than folded in, since this is a repository setting with
no accompanying diff.

`dependabot_security_updates` is also currently `disabled` in
`gh api repos/:owner/:repo` → `security_and_analysis`. That's a separate toggle
and deliberately out of scope here.