docs: add a security policy

[Yashasm18]

What changed

Expanded the new root-level SECURITY.md into a repository-informed security policy. It now documents:

• private vulnerability reporting and coordinated disclosure;
• the local server token and browser-origin boundaries;
• workspace roots, trust decisions, permission modes, and command approvals;
• SecretStore handling and platform-specific file protections;
• MCP OAuth loopback/state handling;
• audit-log redaction and safe evidence sharing; and
• report details tailored to connectors, malicious workspaces, local processes, browser pages, and prompt-injection paths.

Why

OpenWorker can operate on local files, run commands, use MCP/connectors, and send data to model providers. The policy now gives users and contributors a clearer way to recognize and report issues affecting those boundaries.

Validation

• git diff --check
• Documentation-only change; no runtime tests required.