docs: add SECURITY.md for private vulnerabilty reporting

[Youcef3939]

• Implements a security policy as requested in pixelshot disables the Chrome sandbox at every launch site, and the pixelbrowse skill has no untrusted content rule #135
• Directs sensitive or hosted API exploits to the maintainer's email
• Prevents public zero-day disclosures in the issue tracker

[vercel]

@Youcef3939 is attempting to deploy a commit to the andylizf's projects Team on Vercel.

A member of the Team first needs to authorize it.