docs: add SECURITY.md with private vulnerability reporting policy

[bdraco]

Summary

Add a SECURITY.md that directs vulnerability reports through GitHub's private vulnerability reporting, so reporters have a documented private channel and aren't tempted to open a public issue or PR. Cross-reference the policy from CLAUDE.md so future LLM-assisted contributions route reports the same way. Modeled on python-zeroconf#1675.

Details

• SECURITY.md — top-level file (where GitHub's Security tab looks for it). Names the supported channel, supported versions (latest 4.x), and an in-scope / out-of-scope list grounded in dbus-fast's actual attack surface:
  • Crafted D-Bus messages / type signatures hitting _private/unmarshaller.py, _private/marshaller.py, signature.py, _private/address.py.
  • SASL handshake flaws in auth.py (EXTERNAL / ANONYMOUS / DBUS_COOKIE_SHA1).
  • Dispatch / matching bugs in message_bus.py, aio/message_bus.py, service.py that expose or reply to something they shouldn't.
  • Build / packaging pipeline (build_ext.py, TO_CYTHONIZE, wheel contents, signed-release flow).
  • Out of scope: anything that's enforced by dbus-daemon's own policy (D-Bus access control is the daemon's job), running dbus-daemon over an unauthenticated TCP transport, or consumer-side misuse of the API.
• CLAUDE.md — new ## Reporting security issues section between ## Build conventions and ## Useful entry points. Tells the LLM contributor not to open a public issue, PR, or commit naming the bug class and the affected code path when a user describes a suspected vulnerability; instead, point them at SECURITY.md / the private-reporting URL.

Test plan

• SECURITY.md is discoverable via GitHub's Security tab after merge (/security/policy resolves).
• The "Report a vulnerability" button on the Security tab leads to /security/advisories/new.
• lint and commitlint jobs are green.

🤖 Generated with Claude Code

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing docs/add-security-policy (1867907) with main (0614100)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.53%. Comparing base (0614100) to head (1867907).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #651   +/-   ##
=======================================
  Coverage   88.53%   88.53%           
=======================================
  Files          29       29           
  Lines        3488     3488           
  Branches      602      602           
=======================================
  Hits         3088     3088           
  Misses        248      248           
  Partials      152      152           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.