Add SECURITY.md with vulnerability reporting guidelines

[vgpastor]

Context

We handle sensitive data (AED locations used by emergency services) and need a clear process for reporting security vulnerabilities.

What needs to happen

• Add a SECURITY.md to the repository root
• Include: supported versions, how to report a vulnerability (email, not public issue), expected response time, scope
• Contact: info@globalemergency.online

Acceptance criteria

• SECURITY.md added to repo root
• Clear reporting instructions
• Scope of what counts as a security issue defined