chore: add SECURITY.md (private vulnerability reporting policy)

[eddieran]

Why

MaxKey currently has no SECURITY.md. GitHub's Security tab shows the "Suggest a security policy" prompt for exactly this case. This PR is that suggestion.

For an IAM/SSO product specifically, having a structured private-disclosure channel is especially important — protocol-level issues (SAML/OAuth2/OIDC/CAS) come up regularly in IAM products and shouldn't be posted publicly before a fix lands.

What

Adds a draft SECURITY.md at the repo root, modelled on GitHub's standard template with sections tailored for an IAM/SSO project (the in-scope list highlights SAML/OAuth2/OIDC/CAS protocol flaws, JWT issues, password-reset/MFA bypass, SSRF in IdP metadata fetching, etc.).

The most important part is documenting a private reporting channel so security researchers can responsibly disclose findings without having to choose between staying silent and posting to a public issue. The draft points at GitHub's Private Vulnerability Reporting (PVR) feature as the preferred channel, with an email fallback that maintainers can fill in.

Suggested action by maintainers after merge:

1. Enable PVR via Settings → Code security → Private vulnerability reporting → Enable. Free for public repos.
2. Optionally edit the email fallback in SECURITY.md to point at the maintainer's preferred address.

Sections in the draft:

• Reporting a vulnerability (PVR + email fallback)
• What to include
• Scope and supported versions (with explicit out-of-scope examples to reduce triage burden)
• Process / SLA / hall-of-fame

Maintainers should feel free to edit any section — the important thing is that a private channel exists.

Companion issue

See #266 for the request to enable PVR. This PR is the SECURITY.md half; merging this and enabling PVR together unblocks structured private disclosure.

Thanks for considering!