docs(security): add vulnerability reporting policy

[omer-cengel]

Summary

Add a GitHub-recognized security policy that gives researchers a clear private channel for reporting suspected vulnerabilities while documenting sqlcj’s current support posture.

Changes

• Document that sqlcj is pre-1.0, has no supported release line, and targets security fixes at the current master branch.
• Direct suspected vulnerabilities exclusively to GitHub private vulnerability reporting.
• Describe the impact, reproduction, environment, and mitigation details that reports should include.
• Warn reporters not to submit live credentials, personal data, or unrelated sensitive information.
• Direct ordinary non-security defects to public issues without promising response or remediation timelines.

Scope and non-goals

• This change adds repository security documentation only.
• It does not change product code, tests, dependencies, build configuration, CI workflows, or repository settings.
• It does not establish a support window, service-level commitment, confidentiality guarantee, or bug-bounty program.