docs: add SECURITY.md

[clbotdev]

Adds a concise SECURITY.md at the repo root covering:

• Supported versions: hosted service (sendlit.app / api.sendlit.app), latest release (Docker images and @sendlit/* packages), and main
• How to report privately: GitHub private vulnerability reporting (Security tab → Report a vulnerability). It explicitly asks people not to use public issues.
• What to expect: acknowledgement within 3 business days, initial assessment within 7 business days, coordinated disclosure through a GitHub Security Advisory with credit
• Scope: in scope (API incl. OAuth/MCP, web app, packages, hosted service, official Docker images) and out of scope

⚠️ Maintainer action needed before/after merge

Private vulnerability reporting is currently disabled for this repo (gh api repos/codelitdev/sendlit/private-vulnerability-reporting → {"enabled":false}). Until a repo admin enables it (Settings → Code security → Private vulnerability reporting), the link in SECURITY.md won't work.

Not included

• No security email. The issue asks for one but doesn't name an address, so I didn't make one up. If you want an email fallback, tell me the address and I'll add it.
• No /.well-known/security.txt. It's optional and lives on the deployed sites, not in this change.

Closes #70