security: add vulnerability disclosure policy

Replaces internal CVE-scanning notes with a public-facing SECURITY.md
so OpenSSF Scorecard Security-Policy check can detect it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Signed-off-by: Sayan Paul <paul.sayan@gmail.com>

Author: say-paul

SECURITY.md

@@ -0,0 +1,8 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please **do not** open a public GitHub issue for security vulnerabilities.
+
+Report vulnerabilities privately via a
+[GitHub Security Advisory](https://github.com/fedora-iot/greenboot-rs/security/advisories/new).