docs: add security policy (SECURITY.md)

[Reid-n0rc]

Adds a root-level SECURITY.md security policy for the project.

What

• Supported platforms table covering all flavors: Android (ft8af/), desktop for Windows/macOS/Linux (desktop/, Tauri + bundled Hamlib), and iOS (ios/).
• Private reporting via GitHub security advisories, with k1af@ft8af.app as the fallback contact — explicitly not public issues or Discord.
• Scope across platforms: untrusted RF/decoded input in the native ft8_lib/JNI DSP path, CAT/audio handling & the direct-libusb path, desktop Hamlib rig control, the Tauri/Rust IPC surface, and logging-service credentials (Cloudlog, QRZ).
• Upstream coordination note for the vendored ft8_lib DSP core and bundled Hamlib.

Notes

• For the "Report a vulnerability" button to appear, enable Private vulnerability reporting in repo Settings → Security.
• GitHub surfaces the policy from the file on the default branch, so it won't show in the Security tab until this reaches main.
• Response-time SLAs (5/10 business days) are placeholders — adjust as desired.

Closes #592

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 29.46%. Comparing base (ff272aa) to head (c7bbf1e).

Additional details and impacted files

@@            Coverage Diff            @@
##                dev     #593   +/-   ##
=========================================
  Coverage     29.46%   29.46%           
  Complexity      197      197           
=========================================
  Files           179      179           
  Lines         24106    24106           
  Branches       3263     3263           
=========================================
  Hits           7104     7104           
  Misses        16781    16781           
  Partials        221      221           

Flag	Coverage Δ
native	9.93% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Reid-n0rc]

@patrickrb has to enable Private vulnerability reporting

This also needs to be merged into main.

[Reid-n0rc]

@patrickrb — security policy for FT8AF, ready for your review. Heads-up: enable Private vulnerability reporting in repo Settings → Security so the reporting flow works, and the policy only surfaces in the Security tab once it reaches main.