Improve security reporting guidelines in SECURITY.md

[lukem-ts]

Description:

Updating SECURITY.md to include reporting guidelines.

---

Note

Low Risk
Low risk documentation-only change that does not modify any runtime code paths or security controls.

Overview
Updates SECURITY.md to add a new Reporting Guidelines section describing what details to include in vulnerability reports (summary, PoC, impact, suggested fix) and clarifies that SSRF/outbound-request findings should be evaluated against the existing policy.

^{Written by Cursor Bugbot for commit bc1d334. This will update automatically on new commits. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[joeleonjr]

lgtm