[OmarAlJarrah]

Summary

The security label's description sends reporters to SECURITY.md for private reports, and the
file did not exist. This adds it at the root, where GitHub lists it as the repository's security
policy.

• Channel. GitHub's private vulnerability reporting, which is enabled on the repository
  (gh api repos/dexpace/morphic/private-vulnerability-reporting → {"enabled":true}).
• Supported versions. Morphic has no release, so only main's latest commit is supported.
• Scope. The spec and every document it references are untrusted. The caller's options, a file
  an option names, and the code a library caller hands in are trusted. A vulnerability is input
  that gets past a bound the README states: a $ref read outside the spec's directory without
  allow-external-refs, or a document that crashes or exhausts the process instead of ending in a
  diagnostic. With allow-external-refs set, the spec is trusted to name what it reads, but a
  document fetched over the network is not. Wrong or lossy IR, and the cost of a budget the caller
  raised or turned off, are not vulnerabilities. A weakness already filed under the security
  label goes on that issue.

The policy states no response time or disclosure deadline, because none has been agreed; one can
be added when there is. It is a repository policy, not an organisation default in
dexpace/.github, which would cover every dexpace repository and is the organisation's to add.

Closes #1028

Test plan

At 77f8297:

• Each bound the policy states, through go run ./cmd/morphic compile:
  • A $ref written as ../, an absolute path, a file: URI, an http://127.0.0.1 URL, or a
    symbolic link out of the spec's directory: each is refused as openapi/unresolved-ref, and the
    referenced file's text is absent from the output. With --opt allow-external-refs=true the
    same local files resolve, so the probe tells the two settings apart.
  • With allow-external-refs=true, a document served over HTTP whose $ref names a local file,
    by absolute path or by file: URI: refused, and the file's text is absent from the output.
  • A YAML alias bomb gives openapi/alias-amplification. max-source-bytes=40,
    max-source-nodes=5 and max-enum-members=2 on a three-member enum each give
    openapi/budget-exceeded.
• go test ./internal/archtest passes. A link to a heading README.md lacks, planted in
  SECURITY.md, fails TestDocuments_LinksResolve, so the check reads the new file.
• After merge, gh api repos/dexpace/morphic/community/profile --jq '.files.security' names the
  file. The profile reads only the default branch, so this cannot run before then.