Fix understated line counts in SECURITY.md audit scope

[SrvFernandes]

Closes #487

Summary

Updates the audit scope line counts in SECURITY.md to reflect accurate totals across all source files for each contract.

Changes

• Recalculated line counts for learn-token, credential-nft, and progress-tracker contracts
• Included all source files (lib.rs, storage.rs, events.rs, types.rs, metadata.rs, etc.)
• Updated the total line count to match the sum of all contracts

Testing

• Verified line counts using cloc on each contract directory
• Confirmed totals are within 10% of actual values

Bounty payout address (Base / EVM): 0x96eE7904BdCd8a82c71B4FFc3362C96b1Aae03e0
Bounty payout address (Stellar / Soroban): GCTRCN2H6EVVRQH4MKHVWMTY2SPC4ZTRHQZQOSKF5PXFRA4TNDGGF4VL