Add SECURITY.md — enable private vulnerability reporting

[abcgco]

Summary

Add SECURITY.md with instructions for responsible vulnerability disclosure via GitHub Private Vulnerability Reporting (PVR).

PVR allows security researchers to report vulnerabilities privately through GitHub, keeping details confidential until a fix is ready. As a CNA, GitHub can assign CVE IDs directly through this workflow.

[aborruso]

Thanks for the contribution! Two small suggestions:

1. Remove the maintainer note — the line **To enable PVR** (maintainers): Settings → ... is an internal note that doesn't belong in a public-facing SECURITY.md. Reporters don't need to know this.

2. Add newline at end of file — the file is missing a trailing newline.

Suggested content:

# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it
responsibly through **GitHub Private Vulnerability Reporting (PVR)**.

**To report**: Go to the [Security Advisories page](../../security/advisories/new)
and submit a new advisory.

Please **do not** open public issues for security vulnerabilities.

[abcgco]

Thanks for merging!

Could you also enable Private Vulnerability Reporting in the repo settings?

Settings → Code security → Private vulnerability reporting → Enable

Once it's active, I'll submit a detailed advisory with reproduction steps through GitHub's secure channel.

[aborruso]

It's been enabled since yesterday. Thanks @abcgco