Add SECURITY.md to guide security vulnerability reporting

[Ahlam-Banu]

Fixes #11324

Screenshots

No screenshots are required for this documentation change.

Testing strategy

Since this is a documentation-only change, there is no specific testing needed. However, I have ensured that all links within the SECURITY.md file are functional and correctly point to the intended destinations.

Type of change

• ✅ Documentation (non-code change)

I'm happy to incorporate any feedback or adjustments the team might suggest.

[droidmonkey]

@phoerious whatcha think?

@Ahlam-Banu I added some more language to the document, thank you

[Ahlam-Banu]

Thank you for review this! appreciate the enhancements and glad I could assist, thanks again!

[phoerious]

Perhaps some examples for what are security vulnerabilites and what aren't? I don't want to get a host of "hey, when I inject a DLL into your app, I can read everything" reports.

The sentence about not reserving CVEs without our say-so cannot be overemphasised.

[droidmonkey]

Good idea, and yeah still have CVE scars...

[Ahlam-Banu]

I’ve updated the file to include:

• some examples of what constitutes a security vulnerability and what doesn't.
• highlighted the note about not reserving CVEs without approval.
  let me know incase of additional adjustments/modifcations, thanks!

[phoerious]

There will be no SQL injection, because we don't do SQL.

[Ahlam-Banu]

There will be no SQL injection, because we don't do SQL.

file is now updated accordingly :)

[droidmonkey]

There is no need to keep merging develop branch thank you!

[droidmonkey]

Made a few cleanup edits, ready for publishing