Add SECURITY.md clarifying fixtures are synthetic and defining a real-address-inclusion report process

[knytcomics-ui]

Problem

destinations.json's $schema field asserts all addresses are "randomly generated (not real, funded, or attributable to any person or entity)" — but there's no verification process backing that claim, and no documented channel for someone to report a concern if a generated address happens to collide with (or closely resemble) a real, funded testnet account, or if a labelling choice could be read as defamatory toward a real, identifiable project (e.g. an asset code that resembles a real token's ticker).

Requirements

• Add SECURITY.md documenting: the synthetic-data guarantee and how addresses are generated (tie to the XDR/fixture generation tooling from other issues, if it specifies key generation); how to report a suspected real-address collision or a labelling concern privately (not via a public issue); the expected response process/timeline.
• Cross-link from the README.

Acceptance Criteria

• SECURITY.md exists, is linked from the README, and gives a concrete reporting channel (email or private security advisory via GitHub).

Part of the Gryd-lock organization. This repo supplies the labelled testnet fixtures and stub scores consumed by grydlock-oracle-adapter's StubOracle and evaluated end-to-end by grydlock-research.