A security policy for a repo that runs other people's nodes

The work was CONTRIBUTING.md, SECURITY.md, README badges with official links, and converting the logo to WebP. The security policy is the one that mattered.

A generic template is nearly useless here, and the reason is scope. This repo is configuration and packaging over an upstream OP Stack, so a reporter needs to know immediately whether a finding belongs here or upstream. Filing in the wrong place either burns days or, worse, discloses publicly in an issue tracker because no private path was obvious. That is the default behaviour of someone who finds a problem and cannot see where to send it, which is why the policy has to name GitHub’s advisory workflow rather than assume people look for it.

Response commitments have to be ones you can keep, because a broken promise costs more trust than a modest one honoured. And the distribution question is specific to this kind of repo: operators run published images, so a fix in the tree is not a fix in production, and the policy has to say how one reaches them.

Merged upstream as #10, #11, #12.