docs: add security policy

[JasonXuDeveloper]

Summary

• Add SECURITY.md file to establish security policies for the project
• Only JEngine 1.x versions are supported from 2026 onwards
• Provides clear vulnerability reporting guidelines

What's Included

Supported Versions

Version	Supported
1.x	Yes
< 1.0	No

Vulnerability Reporting

• GitHub Security Advisories (preferred method)
• Email to jason@xgamedev.net
• Guidelines on what information to include
• Expected response timelines

Security Best Practices

• Encryption recommendations (AES/ChaCha20 for production)
• Code signing guidance
• Network security tips
• Dependency security notes

Why This Matters

GitHub uses SECURITY.md to:

• Display security policy in the repository's Security tab
• Guide security researchers on proper disclosure
• Show users which versions receive security updates

Test plan

• Review SECURITY.md content for accuracy
• Verify email address is correct
• Check that Security tab shows the policy after merge

🤖 Generated with Claude Code

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.