Improve diffbudget security policy clarity

[rogerchappel]

What changed

• Replaced the generated SECURITY.md supported-versions placeholder with an explicit 0.x support policy.
• Added practical vulnerability reporting guidance that avoids secrets and sensitive reproduction data.

Why it matters

• Public visitors no longer see template text in the security policy.
• Maintainers and users get clearer expectations for early-stage security fixes.

Verification

• rg security placeholder: pass

Remaining limitations

• This is documentation-only; it does not change runtime behavior.