Add SECURITY.md for vulnerability disclosure

[dmchaledev]

Summary

This repo ships a security-policy project but had no vulnerability disclosure
process of its own — no SECURITY.md, and no mention of one anywhere in the
docs. While the templates themselves are static Markdown, the repo does have
an executable attack surface: scripts/customize.sh (Bash, does file
read/write based on user-supplied flags) and .github/workflows/ci.yml.

• Adds SECURITY.md with:
  • Scope: scripts/customize.sh and CI workflow config are in scope;
    factual/compliance corrections to policy content are explicitly out of
    scope and should go through regular issues instead.
  • Reporting instructions that route through GitHub's private Security
    Advisory flow, so nothing sensitive lands in a public issue.
  • A one-line "supported versions" note (main branch only — no release
    branches exist).
• Links to it from the README's Support section for discoverability.

Test plan

• Verified no existing SECURITY.md, SECURITY tab guidance, or
  security-contact info existed anywhere in the repo before this change
• Confirmed the relative link ../../security/advisories/new and
  ../../issues resolve correctly from a repo-root SECURITY.md on
  GitHub
• N/A — documentation-only change, no code paths affected

---

Generated by Claude Code

[dmchaledev]

Superseded by #60 (merged) — main already has SECURITY.md; this PR's content is identical after rebase (zero diff vs main).