docs: fix a few stale bits in SECURITY.md

[Rishet11]

Fixes #2007

Was reading through SECURITY.md and a few things don't match the code anymore:

• Supported versions table still says 0.3.x. We're on 0.9.20, so I just changed it to "latest release" instead of pinning a number that'll go stale again next bump.
• The XSS row says sanitize_label() html-escapes labels (and mentions pyvis, which we don't even use). It doesn't, it just strips control chars + caps length. The actual escaping is html.escape() plus the little esc() helper in exporters/html.py. Fixed the wording to point at the right place.
• Symlink row says followlinks=False is "explicit throughout detect.py". It's really a flag that defaults to False, and extract.py actually walks with followlinks=True (with cycle detection + a containment check). Reworded to say what it actually does.

Docs only, no code touched.

[Copilot]

Pull request overview

Updates SECURITY.md to better match current implementation details referenced in issue #2007, clarifying which components provide specific security mitigations and updating the supported-versions policy language.

Changes:

• Updates the Supported Versions table to reflect current support policy rather than legacy 0.3.x wording.
• Corrects the XSS mitigation description to attribute HTML escaping to the HTML exporter (and clarifies what sanitize_label() does).
• Rewords the symlink traversal mitigation to reflect how followlinks/follow_symlinks are actually used in detect.py vs extract.py.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Rishet11]

good point, dropped the 0.9.x entirely so it's just latest vs older. won't need touching on the next bump now.

[Job28703]

Verified all three corrections against v8 — the sanitize_label()/exporters/html.py split and the detect.py vs extract.py symlink-walk distinction (including the cycle detection in collect_files) both match the code exactly. Thanks for the quick turnaround on this, appreciate it!