Add security policy

[simboss]

Summary

• add a public security policy with supported-version guidance and project-specific scope;
• identify GitHub Private Vulnerability Reporting as the preferred disclosure channel;
• provide infosec@geosolutionsgroup.com as the fallback and cross-component contact;
• document the coordinated disclosure process, including acknowledgement normally within five business days;
• add authorized-testing guidance and safe-harbor language.

Verification

• documentation-only change;
• repository-specific private vulnerability reporting link checked;
• no runtime, build, dependency, or CI behavior changed.