Add SECURITY.md and CODE_OF_CONDUCT.md

[iderex]

A public repository with no security policy tells somebody who finds a
vulnerability to open a public issue, because that is the only route visible to
them. On a board whose whole content is public that is the wrong default, and the
cost of fixing it after the first report is that the report is already public.

Add SECURITY.md. It has to say which route a report takes, that the route is
private, and what a reporter should expect afterwards. It also has to say
something this board specifically owes a reader: an experiment is not supported
software, it may be insecure by construction because that is sometimes what the
question is, and nothing here should be run against a production server. That
sentence is the honest scope of the policy and it is more useful than a promise
this board cannot keep.

Add CODE_OF_CONDUCT.md in the same change. It is the other half of what a public
board owes anybody who shows up, and the two files are read by the same person on
the same visit.

Done when both files exist on the default branch, SECURITY.md names a private
reporting route and states the experiment scope sentence above, and the
repository's community standards page lists both as present.

[iderex]

This cannot land as written, and the missing piece is not in the tree.

The done-condition requires SECURITY.md to name a private reporting route. The
only private route this repository could name is GitHub's private vulnerability
reporting, and it is off:

gh api repos/Flowfin/lab/private-vulnerability-reporting
{"enabled":false}

Turning it on is a repository setting rather than a change to the tree, so it is
not something a pull request can carry. The alternative route is an address
published in the file, and choosing which address a public board publishes is
not an engineering call either. It also runs straight into record 0006, which
says no personal data of any kind is committed here, so an individual's address
is the wrong shape for this tree whoever picks it.

CODE_OF_CONDUCT.md sits behind the same gap rather than beside it. Every
usable code of conduct names where a report goes, and a code of conduct whose
enforcement contact is missing is the blank-page problem #8 was opened for, one
file over.

Writing either file now would put a document in the tree that points at nothing,
on the two subjects where a reader who followed the pointer and found nothing is
worst served.

What unblocks it is one of two answers: private vulnerability reporting enabled
on this repository, or an address the board publishes for both files. The rest
of the change is ready to write the moment either exists, including the scope
sentence this issue asks for about an experiment not being supported software.

[iderex]

A published security policy already applies to this repository, and it answers
half of what this issue is waiting on.

It is not in this tree. The organisation carries one, and GitHub serves it on
this repository's own policy page:

git ls-tree --name-only origin/main SECURITY.md CODE_OF_CONDUCT.md
(no output)

curl -sS https://github.com/Flowfin/lab/security/policy \
  | grep -c 'Use the private reporting form'
1

That second command reads a rendered page rather than a file in a tree, so it
is a statement about what the platform serves today and not about anything
under version control.

What that policy names is one route, and it is the route this issue already
reads as unavailable here:

gh api repos/Flowfin/.github/contents/SECURITY.md --jq '.content' \
  | base64 -d | sed -n '3,6p'
Use the private reporting form under **Security** on the repository the problem
is in. It is enabled on every repository in this organisation. The report stays
between you and the maintainer until there is a fix, and GitHub notifies you
when something changes.

So the second of the two answers this issue offers, an address this board
publishes, is not owed and never was. That choice was made in public and it was
made against publishing an address, which also settles the collision with record
0006 in the same direction. What is left of that half is one setting.

The part that is new is that the gap is live rather than pending. The sentence
above says the form is enabled on every repository in this organisation, and on
this one it is not:

gh api repos/Flowfin/lab/private-vulnerability-reporting --jq '.enabled'
false

gh repo list Flowfin --limit 100 --json name,visibility \
  --jq '.[] | select(.visibility=="PUBLIC") | .name' \
  | while read -r r; do
      gh api "repos/Flowfin/$r/private-vulnerability-reporting" --jq '.enabled'
    done | sort | uniq -c
      4 false
     13 true

Somebody who opens the security tab of this repository is told to use a form
that is not there. The next move available to them is a public issue, which is
the outcome this issue was opened against, and it does not wait for SECURITY.md
to be written before it can happen.

One thing on this issue is not right, and it changes what unblocks the second
file. The code of conduct does not sit behind the same gap. The reporting form
takes vulnerability reports and nothing else, so enabling it gives SECURITY.md
the route it needs and leaves CODE_OF_CONDUCT.md without one. There is no
organisation-level code of conduct for this repository to fall back on the way it
falls back for the policy above:

gh api repos/Flowfin/.github/contents --jq '.[].path'
.github
SECURITY.md
profile

Two different answers rather than one, and this issue asks for both files in a
single change.