Adds .github/SECURITY.md so GitHub links reporters to the private vulnerability reporting form, and points to it from CONTRIBUTING.md. Replaces #25553, carried over with small wording changes. Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>