Add Security Policy

[Abd-Standard]

Summary

The project does not provide a process for reporting security vulnerabilities.

Problem

Security researchers have no official channel for responsible disclosure.

Scope
Create SECURITY.md.
Define vulnerability reporting process.
Establish response expectations.
Document supported versions.