Add SECURITY.md for vulnerability reporting

[ryanfowler]

Summary

• Add a repository-level SECURITY.md with guidance for reporting vulnerabilities privately
• Document supported versions, disclosure expectations, and security-sensitive areas in fetch
• Include user-facing security best practices for sensitive workflows

Testing

• cargo fmt passed
• cargo clippy --locked --all-targets --all-features -- -D warnings passed