Move the security policy to SECURITY.md

[oldergod]

What

This PR moves docs/security.md to SECURITY.md at the repository root and updates its content. The move is its own commit with no content change. This keeps the file history reachable with git log --follow.

Why the move

GitHub surfaces a security policy only from the repository root, from .github/, or from docs/SECURITY.md with that exact capitalisation. The community profile API reports no security policy for this repository today. The "Report a vulnerability" affordance is missing even though the file exists.

Content changes

• The heading now uses the # form instead of the setext form.
• The supported versions table now lists 7.0.x and 6.4.x as supported. The old table listed 4.x and 3.x, which is stale. The exact support window is a reviewer decision. Please adjust the table if the window is different.
• The "Reporting a Vulnerability" section keeps its current wording. The only changes are unwrapped lines and a final period after the Bugcrowd URL.
• The "Threat Model" section is new. It states that a .proto schema is source code. Code generated from an untrusted schema carries the same supply chain risk as other third party source code. The protobuf project states the same position for protoc.

Link check

No other file in the repository references docs/security.md. The mkdocs.yml nav does not list it, so the docs site does not change.