docs: add SECURITY.md (private disclosure + soundness scope)

[Sbcdn]

Adds a security policy for the public repository:

• Private vulnerability reporting (GitHub Security tab, or email).
• Scope: the soundness invariant — dwarf must never accept a certificate or
  lottery ticket that upstream Mithril rejects — and the hashed-byte equivalence
  contract enforced by the harness.
• Out of scope: the documented intentional divergences (registry-pinned), the
  U2048 lottery wide-fallback ceiling (aborts, never falsely accepts), the
  assumed-correct crypto primitives, and host-only tooling.

No code changes.