Document both vulnerability reporting channels (#1088)

Wiki claimed GitHub private vulnerability reporting was the only
channel, but SECURITY.md documents email-only reporting to
contact@karafka.io. Both channels are actually live simultaneously
(GitHub PVR confirmed enabled via the repo's API, SECURITY.md confirmed
current), so the wiki now lists both instead of just one.

Co-authored-by: coipond-writer[bot] <309805719+coipond-writer[bot]@users.noreply.github.com>

Author: coipond-writer[bot]

Pro/Compliance-Certifications.md

@@ -81,7 +81,7 @@ While compliance certifications do **not** apply to Karafka, the project offers
 - **Publicly Viewable Code**: All Karafka components are publicly available on GitHub for security review. Core Karafka is open source (LGPL); Pro and Enterprise components are source-available under a commercial license, not open source
 - **Security Documentation**: Comprehensive guidance on securing your deployment
 - **Supply Chain Verification**: License gem integrity verification and checksum support
-- **Vulnerability Reporting**: Private vulnerability reporting program through GitHub
+- **Vulnerability Reporting**: Report vulnerabilities by email (see [SECURITY.md](https://github.com/karafka/karafka/blob/master/SECURITY.md)) or through GitHub's private vulnerability reporting program
 - **SBOM (Software Bill of Materials)**: Available for dependency tracking and security scanning
 
 ### Enterprise Support