chore: add SECURITY.md, CODEOWNERS, and .editorconfig (#6)

chore: add SECURITY.md, CODEOWNERS, and .editorconfig

Objective: The repository lacks basic governance files for security
reporting, automatic PR reviewer assignment, and editor consistency.

Approach: Add three minimal governance files aligned with the upstream
opendataloader-pdf repository — SECURITY.md with a private email channel,
CODEOWNERS with docs/code ownership split (last-match-wins precedence
applied correctly), and .editorconfig for cross-editor consistency.

Evidence: Documentation and configuration files only — no runtime
behavior change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyunhee-jo

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+indent_style = space
+indent_size = 4
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Default owners for everything in the repository
+* @hyunhee-jo @bundolee @hnc-jglee
+
+# Docs owners (must come after default to take precedence — last-match-wins)
+*.md @suji-cho

.github/SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you think you've identified a security issue in this repository, please **do not** report the issue publicly via the GitHub issue tracker or any other public channel.
+
+Instead, send an email to [open.dataloader@hancom.com](mailto:open.dataloader@hancom.com) with as many details as possible. This is a private mailing list for the maintainers team.
+
+### Security Vulnerability Response
+
+Each report is acknowledged and analyzed by the core maintainers within 3 working days.
+
+Any vulnerability information shared with core maintainers stays within the project and will not be disseminated to other projects unless it is necessary to get the issue fixed.
+
+After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.
+
+## Security Alerts
+
+We will send announcements of security vulnerabilities and steps to remediate on the project announcements.