Define supported security versions and disclosure timelines

[KGFCH2]

Problem

The SECURITY.md document is sparse and does not specify supported scanner versions or vulnerability disclosure expectations.

Proposed Solution

Create a clear version support table and define expected response timeline matrices for security notices.