docs: add SECURITY.md

[markovejnovic]

Part of #90. Names the advisory form and the email, scopes reports to Hyper's own code, and points CONTRIBUTING at it.

Private vulnerability reporting is off on the repo, so the advisory link 404s until it's turned on (Settings > Code security, or gh api -X PUT repos/harmont-dev/hyper/private-vulnerability-reporting). Hold the merge until then.

Written by Claude Code.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[github-actions]

Test Results

  3 files   -   1  200 suites   - 27   2m 14s ⏱️ - 1m 9s
484 tests  - 191  484 ✅  - 190    0 💤 ±0  0 ❌  - 1 
960 runs   - 191  484 ✅  - 190  476 💤 ±0  0 ❌  - 1 

Results for commit f3d2e32. ± Comparison against base commit 3ac24e1.

This pull request removes 191 tests.

hyper-suidhelper::config_network ‑ absent_network_table_means_disabled
hyper-suidhelper::config_network ‑ partial_network_table_without_uplink_disables_not_bricks
hyper-suidhelper::config_network ‑ present_table_with_only_uplink_defaults_clone_pool
hyper-suidhelper::config_seam ‑ override_path_is_consulted_through_the_real_lexical_gate
hyper-suidhelper::config_uid_gid_range ‑ absent_range_yields_default
hyper-suidhelper::config_uid_gid_range ‑ min_exceeds_max_always_rejected
hyper-suidhelper::config_uid_gid_range ‑ valid_range_accepted
hyper-suidhelper::config_uid_gid_range ‑ valid_range_round_trips_via_toml
hyper-suidhelper::config_uid_gid_range ‑ zero_min_always_rejected
hyper-suidhelper::e2e_argv ‑ blockdev_getsz_argv_and_parse_as_root
…