Security researchers have a documented private disclosure path

## User story

As a **security researcher**, I want **a documented disclosure path** so that **I can report a vulnerability privately instead of opening a public issue on a tool that shells out to `ssh` and `zfs` with user-controlled input**.

## Why

There is no `SECURITY.md` today. GitHub's private vulnerability reporting is not enabled. `zfs-replicate` runs `subprocess.Popen(shell=True, …)` with hostnames and dataset names interpolated into the command string (`zfs/replicate/snapshot/send.py:35`, others). That's a security-adjacent surface; a disclosure channel is table stakes.

## Acceptance criteria

- [ ] `SECURITY.md` exists at the repo root covering: supported versions, how to report (email, GitHub private report, or both), expected response time, credit policy.
- [ ] GitHub private vulnerability reporting is enabled in repo settings (checkbox under Security).
- [ ] README's "Getting support" section links to `SECURITY.md`.

## Out of scope

- Fixing the `shell=True` usage — tracked as the argv-list `Command` builder issue.

## Notes

- Target release: **none — chore**
- Source: modernization assessment §4.