Add SECURITY.md with private vulnerability reporting link

Author: aborruso

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please use [GitHub's private vulnerability reporting](https://github.com/ondata/istat_mcp_server/security/advisories/new) to report security issues.
+
+We will respond as soon as possible and coordinate a fix before public disclosure.
+
+## Scope
+
+This server is **read-only** and uses only public ISTAT SDMX API endpoints. It does not handle authentication, store credentials, or modify any data.