feat(scorecard): Signed-Releases (provenance asset) + Security-Policy…

… etoffee (#10)

- release.yml : attache provenance.intoto.jsonl aux assets de la release
  (Scorecard Signed-Releases cherche ce fichier, pas seulement lattestation OCI).
  contents:write requis pour gh release upload.
- SECURITY.md : lien advisory + email + divulgation coordonnee + delais
  (Security-Policy tiers 1/2/3).