[Security] Suggest enabling private vulnerability reporting / adding SECURITY.md

Hi maintainers,

dynamic-tp's Security tab currently shows GitHub's "Suggest a security policy" prompt — there's no `SECURITY.md` and Private Vulnerability Reporting (PVR) is disabled.

I checked the API:

```
GET /repos/dromara/dynamic-tp/private-vulnerability-reporting
=> {"enabled": false}
```

This makes responsible disclosure awkward, because the only options researchers have right now are (a) post in a public issue (which gives attackers a head-start before a fix lands) or (b) try to find a maintainer email.

**Two options I'd love your help with:**

- **Option A (preferred):** Enable Private Vulnerability Reporting via *Settings → Code security → Private vulnerability reporting → Enable*. Free for public repos, hides triage discussion from the public, and gives researchers a structured GHSA channel.
- **Option B:** Confirm a preferred private channel (email or otherwise) and I can route there.

I've also opened a companion PR adding a draft `SECURITY.md` based on the standard GitHub template. It's purely the "Suggest a security policy" suggestion — feel free to edit anything in it; the important thing is that *a private reporting channel exists*.

Thanks for considering!

— Eddie Ran