Update SECURITY.md with vulnerability reporting guidelines

[gcjordi]

Description

Adds a vulnerability reporting section to SECURITY.md, directing security researchers to GitHub Private Vulnerability Reporting instead of public Issues.

This addresses the security disclosure guidance identified during the Codex review of PR #5.

Type of change

• Documentation

Related issue

Follow-up to Codex review feedback on PR #5.

What changed?

• Added a dedicated vulnerability reporting section to SECURITY.md.
• Directed vulnerability reports to GitHub Private Vulnerability Reporting.
• Added guidance on the information that should be included in a security report.
• Added responsible disclosure guidance.

Testing

• Documentation-only change reviewed manually.
• Verified that Private Vulnerability Reporting is enabled for the repository.

[gcjordi]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: a99621d4f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".