chore: add security hardening

[nikosxenakis]

Summary

• Add SECURITY.md with DFINITY's vulnerability reporting policy and bug bounty program details
• Add minimumReleaseAge: 10080 to pnpm-workspace.yaml to ignore dependency updates released less than 7 days ago

Context

Part of SDK-2664 security hardening across JS/TS repos.

Note: ignore-scripts=true is not added to .npmrc because this repo uses onlyBuiltDependencies in pnpm-workspace.yaml (which already restricts which packages can run install scripts). Adding ignore-scripts=true to .npmrc would override onlyBuiltDependencies and break @dfinity/pic's postinstall binary download.