[INFOSEC-634] Add security policy

[bhargavirao24]

Description

Adds a SECURITY.md file so security researchers have clear instructions for privately reporting vulnerabilities in bitcoinjs-lib.

Because this repository is a fork, the policy applies to BitGo-specific changes and directs vulnerabilities affecting the upstream project to the upstream security policy.

The policy:

• directs vulnerability reports involving BitGo-specific changes to security@bitgo.com
• explains what information to include in a report
• provides guidance for securely sharing sensitive material
• clarifies that Bugcrowd eligibility depends on the program scope
• requests coordinated disclosure

Dependency blocker

This PR is blocked by the production dependency audit. #92 updates the vulnerable cipher-base and sha.js versions and removes their expired audit exceptions. #92 must merge first; this branch can then be rebased onto master so the audit check passes.

Testing

Not applicable. This is a documentation-only change.

Tracking

INFOSEC-634: Publish SECURITY.md for public repositories

Related remediation: #92

[linear-code]

INFOSEC-634