Create and publish a repository security policy

### Description

Create a clear, maintainable security policy that gives researchers and contributors a responsible path to report vulnerabilities without publicly disclosing exploitable details.

### Action Items

- [ ] Review Hack for LA organization guidance and existing repository documentation for the appropriate security contact and escalation path.
- [ ] Define the supported reporting channel(s), avoiding public GitHub issues for undisclosed vulnerabilities.
- [ ] Define the information a report should include, such as affected component, reproduction steps, impact, and any known mitigation.
- [ ] Define maintainer expectations for acknowledgement, triage, remediation, coordinated disclosure, and reporter follow-up without promising unsupported response-time SLAs.
- [ ] Define how to handle accidentally exposed credentials, including immediate revocation/rotation and alert triage.
- [ ] Add a concise `SECURITY.md` in GitHub's recognized location and link to relevant project/contact documentation.
- [ ] Verify GitHub renders the policy on the repository Security page and that the contact path is reachable by a contributor.
- [ ] Review the policy with maintainers and document ownership for keeping contact details current.

### Additional Information

Related work: #746 (secret scanning and push protection), #741 (CodeQL), and #745 (merge-governance spike).

Keep this policy focused on vulnerability reporting and response. It should not duplicate general contribution, bug-report, privacy, or incident-management documentation.

Start by reviewing Hack for LA organization guidance and the repository's existing documentation to identify the supported security contact and escalation path. Create SECURITY.md in GitHub's recognized location, then verify the policy renders on the repository Security page, the contact path works, maintainers approve it, and ownership for updates is documented.

Written by the indexing model from the issue text.