[INFOSEC-634] Add security policy

[bhargavirao24]

Description

Adds a SECURITY.md file so security researchers have clear instructions for privately reporting vulnerabilities in io-ts.

Because this repository is a fork, the policy applies to BitGo-specific changes and directs vulnerabilities affecting the upstream project to the upstream security policy.

The policy:

• directs vulnerability reports involving BitGo-specific changes to security@bitgo.com
• explains what information to include in a report
• provides guidance for securely sharing sensitive material
• clarifies that Bugcrowd eligibility depends on the program scope
• requests coordinated disclosure

Testing

Not applicable. This is a documentation-only change.

Tracking

INFOSEC-634: Publish SECURITY.md for public repositories

[linear-code]

INFOSEC-634

[abhishekdhakla]

Standard SECURITY.md with correct upstream/fork distinction and private disclosure instructions. LGTM.