docs: add security reporting guidance

[junghwan325-cyber]

Summary

• add a root SECURITY.md with private-reporting guidance for self-hosted OpenTag deployments
• document secret-handling checks for Slack/model/Linear/Notion/Redis tokens before sharing logs or PRs
• link the security guidance from the README

Testing

• git diff --check
• docs-only change; no runtime tests run