Add SECURITY.md with vulnerability reporting policy

[KardelRuveyda]

What

Adds a standard SECURITY.md to the repository root.

Why

• GitHub treats SECURITY.md as a community health file: once merged, the repo's Security tab will show this policy, and contributors get a clear, private channel for reporting vulnerabilities instead of opening public issues.
• Helps fill out the Community Standards checklist on the repo profile.
• The policy is intentionally light-weight and tailored to a research codebase — no commercial SLA, no extra email infrastructure required.

What's in the file

• Supported versions — only the latest main is patched (honest for a research repo).
• Reporting a vulnerability — two private channels:
  1. GitHub's built-in Report a vulnerability (preferred, requires no setup)
  2. Email the corresponding author listed in CITATION.cff
• What to include / What to expect — keeps triage efficient.
• Scope / Out of scope — clarifies that issues in upstream dependencies (nnU-Net, Voreen, VTK, etc.) belong to those projects, and that automated-scanner noise without impact is out of scope.

Notes for the maintainer

• No code is touched — docs-only change.
• The email channel reuses the corresponding author already published in the paper, so no new mailing list is required.
• Feel free to swap the contact details for a dedicated security alias if you prefer.