Add SECURITY.md and notes on PVR

[andyblundell]

Summary

Adds a SECURITY.md file to the repository and documents best practices for allowing others to report security problems.

Changes

Added SECURITY.md

• Provides guidance on how to report security vulnerabilities
• Uses GitHub's Private Vulnerability Reporting (PVR) as the primary reporting method
• Includes a direct link to the vulnerability reporting form for ease of use
• Retains contact details for general security enquiries

Updated practices/securing-repositories.md

Added a new section "Allowing others to report security problems" covering:

• Adding a SECURITY.md file to repositories
• Enabling Security advisories
• Enabling Private vulnerability reporting for public repositories
• Monitoring and acting on security advisories

Also links to this repository's SECURITY.md as a working example.

Why

Public repositories should make it easy for security researchers and users to report vulnerabilities privately. GitHub's Private Vulnerability Reporting provides a low-friction, secure channel that doesn't require external reporters to manage email or tokens — they just need a GitHub account.

Checklist

• SECURITY.md added to repository root
• Private vulnerability reporting enabled in repository settings
• Documentation updated with guidance for other teams

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud