docs(security): add SECURITY.md with vulnerability reporting policy

[Akalanka1337]

Summary

This PR adds a SECURITY.md file to provide a clear security disclosure process for Tone.js.

Motivation

Currently, the repository does not provide guidance for reporting security vulnerabilities. Adding a security policy helps security researchers, users, and maintainers coordinate responsible disclosure and establishes expectations around supported versions and security updates.

Changes

• Add SECURITY.md
• Define supported version policy
• Add private vulnerability reporting guidance
• Clarify what constitutes a security issue for Tone.js
• Document coordinated disclosure expectations
• Define maintainer response expectations
• Add guidance regarding npm/CDN consumers and security updates

Why this matters

Tone.js is widely distributed through npm and CDN-based deployments. A documented security policy improves the project's security posture by:

• Providing a clear path for responsible vulnerability disclosure
• Reducing the likelihood of sensitive reports being disclosed publicly
• Helping users understand support expectations
• Aligning the repository with GitHub security best practices

Notes

The policy intentionally focuses on vulnerabilities that impact Tone.js consumers, package integrity, runtime security, or the software supply chain, while directing general bugs and feature requests to the existing issue tracker.

Feedback on supported-version policy or preferred disclosure channels is welcome.