Add SECURITY.md with a private vulnerability disclosure path

[ryanhill1]

Adds a SECURITY.md to pyqasm, which currently has no documented way to report a
vulnerability privately. A researcher's only options today are a public issue, which
discloses the problem to everyone at once, or guessing at an email address.

qBraid/qBraid already carries one; this adapts it for pyqasm and points at this
repository's own private advisory form.

Two deliberate differences from the qBraid/qBraid version:

• No hardcoded version table. The existing policy pins "0.7.x" as supported, which
  has been stale since 0.8. This one states support for the most recent minor release,
  so it does not need editing on every release.
• A section on upstream dependencies. pyqasm reaches third-party packages through
  optional extras, and a reporter should know where to send an issue that originates
  upstream, and that we still want to hear about it so we can assess exposure through
  a path this package creates.

Related: #382.

[argus-eye]

Argus review

Auto-review is off for this repo. Tick the box below to run a review on this PR.

• Trigger Argus review

Estimated cost

• Files changed: 1
• Diff lines (±): 44
• Historical avg: ~243.6k tokens · ~$0.95 · across last 10 review(s)

Tip: you can also comment @argus-eye review at any time.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d8e5a819-11a8-4f6c-a619-4654e8ebe71a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!