SECURITY.md points at private vulnerability reporting, but it is not enabled on this repository

Nobody has claimed this yet.

SECURITY.md says to report vulnerabilities privately through the GitHub Security tab and not to open a public issue. That link does not work for anyone outside the project, because private vulnerability reporting is not enabled here:

```
$ gh api --method POST repos/LLNL/zfp/security-advisories/reports ...
{"message":"Repository does not have private vulnerability reporting enabled","status":"403"}
```

So the policy points at a closed door while also asking people not to use the open one. It is a checkbox under Settings, Code security.

I ask because I have a memory-safety finding in the decompression path that I would rather send you privately than either sit on or post here against your stated preference. Email works too if you would rather, just tell me where.

No security detail in this issue. Thanks for having a policy at all, most projects I look at do not.

Review SECURITY.md and the repository's Settings > Code security area. Enable private vulnerability reporting, then verify that the Security tab link and the reported gh API request no longer return the stated 403; confirm the policy gives contributors a usable private reporting route.

Written by the indexing model from the issue text.