docs: add a security policy and a private disclosure route

[Minipada]

The repository has no security policy, so the only route open to someone finding a
vulnerability is a public issue — which is the disclosure. This adds SECURITY.md at the repo
root and links it from everywhere a reporter is likely to look.

What it says

• Supported branches, not versions. DC has no tags and no releases (every package.xml is
  at 0.1.0), so a "supported versions" table would be fiction. The table names branch tips:
  jazzy gets fixes first, humble gets high/critical only, feature branches and forks get
  nothing.
• Private reporting route: GitHub private vulnerability reporting
  (advisories/new),
  with d.bensoussan@proton.me as the fallback. Already enabled on the repository — verified
  via gh api repos/Minipada/ros2_data_collection/private-vulnerability-reporting →
  {"enabled":true}, so the channel behind the document is live.
• Response targets: acknowledgement 3 business days, accept/reject + severity 10 business
  days, status update every 14 days. Stated as targets, with the single-maintainer reality
  spelled out, rather than as an SLA nobody can hold to.
• Disclosure: coordinated, 90-day default embargo or until the fix lands on jazzy,
  whichever is first; published as a GHSA, CVE requested through GitHub when warranted,
  reporter credited unless they decline.
• Scope: the demo configs and tools/infrastructure/ (unauthenticated Postgres, default
  credentials) are deliberately trivial so a demo runs on a laptop — out of scope, as are ROS 2
  and third-party deps unless DC's use of them creates the problem. Documentation presenting
  a demo credential as production-ready is explicitly a bug, filed as a normal issue.

Where it is linked

README.md is a symlink to doc/src/dc/introduction.md, so the link uses the
blob/jazzy/SECURITY.md absolute form the docs already use for repo files — a relative link
would break on the docs site. The README gets a list entry plus a # Security section;
doc/src/dc/contributing.md gets a TLDR row and a "Found a vulnerability?" subsection; and
.github/ISSUE_TEMPLATE/config.yml gets a contact link, which puts "Report a security
vulnerability" in the new-issue chooser itself — right where someone is about to do the wrong
thing.

Caveat

GitHub surfaces SECURITY.md from the default branch, which is still humble. Until this
reaches humble (or the default branch moves to jazzy), the Security tab will show no policy
even though the file exists here. Private vulnerability reporting is repo-level and works
regardless.

Verification

prek run --files SECURITY.md doc/src/dc/introduction.md doc/src/dc/contributing.md .github/ISSUE_TEMPLATE/config.yml --skip build-doc passes. No code touched.

Closes #302

🤖 Generated with Claude Code

https://claude.ai/code/session_012ch5gm7LspscVZKJAHQP9B

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.54%. Comparing base (57fda1b) to head (40dc88b).

Additional details and impacted files

@@           Coverage Diff           @@
##            jazzy     #353   +/-   ##
=======================================
  Coverage   67.54%   67.54%           
=======================================
  Files          95       95           
  Lines        5884     5884           
=======================================
  Hits         3974     3974           
  Misses       1910     1910           

Flag	Coverage Δ
cpp-jazzy	67.54% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.