docs: add security reporting guidance

[willchen96]

Summary

Add security reporting guidance to the contributing guide.

Changes

• Added a Security section to CONTRIBUTING.md.
• Directs security vulnerability reports to GitHub private vulnerability reporting instead of public issues.
• Notes that maintainers will aim to respond promptly and coordinate disclosure.

Why

Security reports should avoid public disclosure until they can be reviewed and remediated responsibly.

Testing

• Not run; docs-only change.