[Security] Suggest enabling private vulnerability reporting / adding SECURITY.md

Hi maintainers,

SMS4J's Security tab currently shows GitHub's "Suggest a security policy" prompt — there's no `SECURITY.md` and Private Vulnerability Reporting (PVR) is disabled.

I checked the API:

```
GET /repos/dromara/SMS4J/private-vulnerability-reporting
=> {"enabled": false}
```

For an SMS-sending abstraction specifically, having a structured private-disclosure channel matters because findings often touch credential handling and rate-limit-bypass paths that adapter authors should fix before they're widely known.

**Two options I'd love your help with:**

- **Option A (preferred):** Enable Private Vulnerability Reporting via *Settings → Code security → Private vulnerability reporting → Enable*. Free for public repos, hides triage discussion from the public, and gives researchers a structured GHSA channel.
- **Option B:** Confirm a preferred private channel (email or otherwise) and I can route there.

I've also opened a companion PR adding a draft `SECURITY.md` based on the standard GitHub template, with sections tailored for an SMS / credential-handling library. It's purely the "Suggest a security policy" suggestion — feel free to edit anything in it; the important thing is that *a private reporting channel exists*.

Thanks for considering!

— Eddie Ran

Start by reviewing the draft SECURITY.md from the companion PR and the standard GitHub security-policy template. Then check Settings → Code security → Private vulnerability reporting. Done means the repository has a private reporting channel enabled or a confirmed private contact, with SECURITY.md documenting the chosen process.

Written by the indexing model from the issue text.