docs: add security disclosure policy

[bingmokaka]

Summary

• add a root SECURITY.md with responsible disclosure channels
• define in-scope and out-of-scope areas for SwiftRemit contracts, API, frontend, and deployment assets
• document response SLA, safe harbor expectations, and bounty notes

Closes #939

[vercel]

@bingmokaka is attempting to deploy a commit to the Harold's projects Team on Vercel.

A member of the Team first needs to authorize it.