docs: add security disclosure policy

[peterxing]

Summary

• adds a root SECURITY.md so GitHub exposes a clear private reporting path
• repeats the rudy@blacksky.app security contact already mentioned in CONTRIBUTING.md
• adds a concise report template, coordinated-disclosure flow, and safe scope guidance for rsky services/crates

Verification

• git diff --check
• direct marker check for reporting address, coordinated disclosure, private-reporting wording, and scope guidance

Closes #183.

[peterxing]

I opened this as a narrow responsible-disclosure policy PR using the existing private reporting contact.

If helpful, I can turn it into either:

• A$390 security-policy readback: supported versions, reporting path, safe harbor, response targets, and rsky-specific scope examples
• A$690 security-program launch packet: scope matrix, severity/reward rubric, disclosure SLA, triage workflow, advisory template, and announcement copy

Details/proof/payment options: https://0741ec59.farmbot-platform-mvp.pages.dev/hire-agent/

Default payment is USDC on Base or Polygon, or invoice if preferred.