docs: add SECURITY.md for vulnerability disclosure process

[Nivesh353]

Summary

Adds a SECURITY.md documenting the official vulnerability disclosure process, as promised in #28.

What's included

• Reporting channels — GitHub Private Vulnerability Reporting (preferred) and a direct email fallback (shreyas@lyzr.ai, PGP available on request)
• What to include in a report — description/impact, repro steps or PoC, affected version, suggested mitigation
• Response SLA — acknowledgment within 3 business days, initial assessment within 7 business days
• Scope — covers the gitagent CLI/SDK/runtime; third-party dependency issues should go upstream but can also be flagged here
• Supported versions — security fixes land on main only; older versions are not backported

Closes #28

[shreyas-lyzr]

Pure documentation addition — no code, no dependencies, no logic changes. Content is accurate and well-structured.

Security pass: no secrets or credentials in the file, no code paths introduced, no attack surface change. The disclosure flow (GitHub private reporting preferred, email fallback with PGP option) is appropriate. Response SLA commitments (3 business days acknowledgment, 7 days initial assessment) are reasonable and standard. Scope boundaries are clearly drawn.

One minor observation for future iteration: the 'Supported Versions' table is often expected as a table format by GitHub's security advisory tooling, but the prose form here is perfectly readable and not a blocker.

Looks good to merge.