docs: add security policy

[kdy1]

Description:

Adds a root-level SECURITY.md for SWC. The policy documents supported versions, private vulnerability reporting through kdy.1997.dev@gmail.com, SWC's security model as a build tool rather than a SaaS or multi-tenant sandbox, and the intended in-scope and out-of-scope report categories.

This gives users a clear private reporting path and sets expectations for integrators that accept untrusted input.

BREAKING CHANGE:

None.

Related issue (if exists):

None.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 06af650

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codspeed-hq]

Merging this PR will not alter performance

✅ 219 untouched benchmarks
⏩ 31 skipped benchmarks¹

---

_{Comparing kdy1:kdy1/add-security-policy (06af650) with main (aa5b539)}

Footnotes

1. 31 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩