docs: add private security reporting policy

Author: etr

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+Please report suspected security vulnerabilities privately. Do not include
+exploit details in a public issue or pull request before coordinated disclosure.
+
+Use **Report a vulnerability** on the
+[GitHub Security Advisories page](https://github.com/etr/libhttpserver/security/advisories)
+when it is available. Otherwise, email the maintainer at
+[electrictwister2000@gmail.com](mailto:electrictwister2000@gmail.com).
+
+Include the affected version or commit, build configuration, dependency versions,
+impact, and reproduction steps or a minimal proof of concept. Reports affecting
+older releases are welcome; please identify the exact version tested.
+
+The maintainer and reporter will coordinate a fix, disclosure timing, and credit.
+Please identify any existing CVE request so that duplicate identifiers can be
+avoided, and state how you would like to be credited.