Chore/add security.md

[Jamestth]

Summary

• Add SECURITY.md with vulnerability reporting instructions (via GitHub Security Advisories), a pointer to the CI security workflow, and GovTech's security disclaimer
• Update make security-scan to use Semgrep (matching the CI pipeline) instead of Bandit, and remove the unused security-scan-json target