docs: add SECURITY.md

[Kodaxadev]

Summary

• Add responsible disclosure policy (email, 48h ack, 7d assessment)
• Define scope: secret pattern bypasses, hook bypass, file traversal, installer safety, npm contents
• Explicitly note zero-dep supply chain posture

GitHub and Socket both surface SECURITY.md as a trust signal.

🤖 Generated with Claude Code