Update SECURITY.md to reflect bug bounty program

[kparkinson-ld]

Summary

Updates SECURITY.md to direct security reporters to LaunchDarkly's Bug Bounty program.

Changes

• Security issues should be reported through the Bug Bounty program rather than via GitHub Issues or PRs
• Clarifies that valid security issues may be eligible for a bounty

This is a cross-repository update to standardize security reporting instructions across LaunchDarkly repositories.

---

Note

Low Risk
Documentation-only change to security reporting instructions; no application or infrastructure code is modified.

Overview
SECURITY.md is updated so security reporting matches LaunchDarkly’s current process across repos.

The doc now boldly warns not to file GitHub Issues or PRs for vulnerabilities, with clearer rationale about public exposure. Reporting is directed to the Bugcrowd Bug Bounty program instead of the previous HackerOne link, and a line is added asking reporters not to contact LaunchDarkly staff directly.

^{Reviewed by Cursor Bugbot for commit 34b1eec. Bugbot is set up for automated code reviews on this repo. Configure here.}