[codex] Add security policy

[klboke]

Summary

• Add a repository-level SECURITY.md file.
• Document the private vulnerability reporting channel for kkFileView.
• Provide bilingual guidance for supported versions, responsible disclosure, and what information to include in a private report.

Why

GitHub renders /security/policy from SECURITY.md. The repository already has Private Vulnerability Reporting enabled, so this file gives reporters a visible policy page and reinforces that vulnerability details should not be posted publicly.

Related to #769.

Validation

• Ran git diff --check.
• Ran git diff --cached --check before committing.
• Documentation-only change; no runtime tests required.