Add SECURITY.md for OEM vulnerability disclosure

[barfle]

Summary

• Add a thin SECURITY.md with the disclosure contact and a link to the public OEM supplier information page

Test plan

• Confirm SECURITY.md is visible at repo root
• Confirm the docs URL and support contact are correct

[cursor]

Approved. Cursor Bugbot and Cursor Security Agent were not running after the initial check, so those signals were skipped. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}