docs: add SECURITY.md with vulnerability disclosure policy

[Dev9269]

The repository currently shows 'Suggest a security policy' on the Security tab. This PR adds a SECURITY.md with:

• Supported version table
• Private vulnerability reporting instructions (GitHub + email)
• Disclosure timeline policy
• Reference to the previous CVE-2025-32778 advisory
• Security-relevant configuration notes for future reporters

Fixes the missing security policy on the repo.

[Dev9269]

@lissy93 This adds a SECURITY.md to replace the 'Suggest a security policy' prompt on the Security tab. Includes disclosure instructions, supported versions, and references CVE-2025-32778. Ready for review whenever you have a moment.

[netlify]

✅ Deploy Preview for web-check ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	e1472c5
🔍 Latest deploy log	https://app.netlify.com/projects/web-check/deploys/6a67c2bdfa89610009e5d358
😎 Deploy Preview	https://deploy-preview-322--web-check.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[lissy93]

Thanks @Dev9269!

Good spot that security.md is missing, I should definitely create that.
I need to come back and spend a bit of time updating web-check in general

I usually don't list things which need to be kept updated in the security policy. Since the known CVEs can already be seen in the security tab, and for the version support if the version is linier then it's often just easier to say current major + minor is supported.

Usually it's easier if maintainer writes security.md, as the content will differ from repo to repo.

I'll take a proper look at the PR soon :)

[liss-bot]

Hey @Dev9269, this has now been implemented in #346, and will be released shortly in 2.2.8 😇

[lissy93]

I've added a SECURITY.md here: https://github.com/lissy93/web-check/blob/master/.github/SECURITY.md

Usually this file needs to be written by maintainer, or someone who understands the scope, model and security boundaries. Which is why I did not merge this PR.