docs: add private security reporting policy

[Harbor404]

What this changes

Adds SECURITY.md so security reports have a documented private channel. The policy matches the existing CopilotKit organization policy and directs reports to security@copilotkit.ai; it asks reporters not to disclose vulnerability details publicly.

Closes #684.

Where it runs

• New state that outlives a request? None.
• What happens on the second replica? Not applicable; this is repository metadata.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No.

Boundary and audit

• Every acting call still goes through the gateway. Not touched.
• New refusals and new failures each write a row. None added.
• Nothing new is trusted from the client. Not touched.

Changelog

No changelog entry: this documentation-only change does not alter deployment behavior.

Proof

• cmp against CopilotKit/CopilotKit/SECURITY.md: exact match.
• git diff --cached --check: no output.
• bunx biome format --check SECURITY.md: exits 0.
• gh api repos/CopilotKit/OpenBot/community/profile reported security_policy: null before this change; GitHub will discover this file at the repository root after merge.

[davidmckayv]

Closing. A security policy is a commitment made by the maintainers, and outside contributors don't write it for them. This file promises response times on CopilotKit's behalf (acknowledgement within 48 hours, investigation within 5 business days, a fix within 30 days) and names CopilotKit's security inbox and Discord. If OpenBot needs a SECURITY.md, the team will add one.