docs: add security policy (SFT-7581)

[Jacksper13]

Summary

• add a repository security policy
• direct private vulnerability reports to Foundation's responsible disclosure form and encrypted email contact

Validation

• confirmed all contact links and the security email use the foundation.xyz domain
• documentation-only change

SFT-7581