[rpgmem]

Add a security policy document outlining supported versions and vulnerability reporting.

Closes #

Problem

Change

Tests

Risk

Screenshots

Checklist

• Base is develop; no version bump
• CHANGELOG.md — one bullet at the end of its heading under [Unreleased], citing the issue, ≤300 characters
• Documentation tab (src/admin/documentation.php) updated, if an administrator sees or configures the change
• Catalogues regenerated with bin/i18n.sh and the new entries translated
• Fast checks run locally: PHPUnit for the touched tests, PHPStan, PHPCS, and npm run lint / npm test if JS or CSS changed