crossplane.io serves no /.well-known/security.txt (RFC 9116)

`https://crossplane.io/.well-known/security.txt` returns 404. [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116) makes `/.well-known/security.txt` the standard, machine-discoverable pointer to a project's disclosure channel. Crossplane already runs a security program (`crossplane-security@lists.cncf.io`, per SECURITY.md); this just makes it discoverable.

A small security.txt served from the site's static directory would resolve it — glad to send a PR once I know which dir the site serves static assets from. I used AI assistance; I reproduced the 404 myself.

Locate the site's static directory and review SECURITY.md for the existing security contact, then inspect how static assets are served. Add the RFC 9116 security.txt there and verify that https://crossplane.io/.well-known/security.txt is served instead of returning 404.

Written by the indexing model from the issue text.