Enable private vulnerability reporting and confirm security contact

[stubbi]

Per SECURITY.md MAINTAINER TODOs: enable GitHub private vulnerability reporting in repo settings, and confirm or replace the security contact address.

Acceptance: private reporting is on; SECURITY.md reflects the real contact.