Play Framework

docs: add SECURITY.md with disclosure policy

Defines how to report security vulnerabilities in this Play 1.12 fork.
Preferred path is GitHub's private vulnerability reporting (the "Report
a vulnerability" button on the Security tab), with email as fallback.

Covers:
- Reporter expectations (acknowledgement within 3 business days, triage
  within 14 days, default 90-day disclosure window)
- Supported versions (1.12.x current; 1.11.x and earlier not maintained
  on this fork — apps that can't move to Java 25 should stay on
  upstream Play 1.11.x and not expect backports here)
- Scope (framework code, bundled modules, CLI, skel apps, build
  pipeline are in scope; downstream applications and third-party
  library upstreams are not, except where Play-side configuration
  makes the exposure exploitable)
- What we do on report (acknowledge, triage, develop fix in private
  branch, ship as 1.12.x patch, publish advisory + credit reporter)

Repo settings flipped alongside this commit (not version-controlled —
they're GitHub Settings, set via gh API):
- Dependabot alerts: enabled (was disabled). Surfaces CVEs in
  installed deps; complements Renovate's version-update PRs.
- Private vulnerability reporting: enabled (was disabled). Makes the
  "Report a vulnerability" button this SECURITY.md points at actually
  appear on the Security tab.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>