docs(security): add SECURITY.md security policy

[rejifald]

What

Adds a repository security policy at the repo root (SECURITY.md), where GitHub's Security tab and the new-issue flow surface it. The repo previously shipped without one, so GitHub's community-standards check flagged it missing and vulnerability reporters had no documented private channel.

Contents

• Supported versions — latest 1.0.x / 1.0.0-rc.x receive security fixes; 0.x does not.
• Private reporting — GitHub private vulnerability reporting (already enabled on this repo) as the preferred channel, maintainer email as fallback; explicit "do not open a public issue."
• What to expect — 3-business-day acknowledgement, ~90-day coordinated fix/disclosure, reporter credit, short good-faith safe-harbor statement.
• Scope — tuned to StitchAPI's real risk surface (credential leakage, OpenAPI codegen injection, playground sandbox / egress-confinement escape, SSRF/ReDoS), plus an out-of-scope list to filter scanner noise.

Why

Clears one of the v1.0 GA-cut checklist items (see docs/RELEASE.md and the GA blockers).

Notes

• Docs only — no code changes.
• Prettier-clean; full local pre-push suite (format, lint, contract, typecheck, tests, build-docs, yakir) green.

🤖 Generated with Claude Code