Link SECURITY.md to public SECURITY-POLICY.md

[negillett]

Summary

• Point coordinated disclosure link at intentproof-infra SECURITY-POLICY.md.

Test plan

• Docs-only change

[cursor]

PR Summary

Low Risk
Low risk docs-only change that updates an external link and wording; no code or runtime behavior is affected.

Overview
Updates SECURITY.md to point the coordinated disclosure reference from SECURITY-PROCESS.md to the public SECURITY-POLICY.md, and adjusts the accompanying description to match the new policy scope (public disclosure and dependency-scanning rules).

^{Reviewed by Cursor Bugbot for commit 4093fac. Bugbot is set up for automated code reviews on this repo. Configure here.}