feat: add security policy contact details and create SECURITY-INSIGHT…

[BigJohn-dev]

Closes #306

Summary

Fix the broken security contact reference in SECURITY.md (backlog #98).

SECURITY.md directed vulnerability reporters to "the contact information in the README," but README.md had no security contact — creating a dead end for responsible disclosure.

Changes

File	Change
SECURITY.md	Replace indirect README reference with direct security@chainforge.app email link
README.md	Add Security section with email contact and GitHub private disclosure link
.github/SECURITY-INSIGHTS.yml	New — declares contact, supported versions, languages, and policy URL for OpenSSF Scorecard and similar tooling

Motivation

ChainForge handles sensitive humanitarian aid data and recipient PII. A functional security disclosure path is a baseline requirement. The existing wording created a circular reference with no actual contact.

Acceptance Criteria

• SECURITY.md lists security@chainforge.app as the primary reporting channel
• README.md contains a Security section with the same email
• .github/SECURITY-INSIGHTS.yml declares supported versions, languages, and policy link
• gh api repos/ChainForgee/ChainForge/security-advisories returns configured contact metadata

Testing

No automated tests required — documentation-only change. Verify by:

# Confirm SECURITY-INSIGHTS.yml is valid YAML
python -c "import yaml; yaml.safe_load(open('.github/SECURITY-INSIGHTS.yml'))"

# Confirm email appears in all three files
grep -n "security@chainforge.app" SECURITY.md README.md .github/SECURITY-INSIGHTS.yml

[kilodesodiq-arch]

Awesome work on this! Pure docs change — no CI needed 🙌 Merging now. Thanks for the contribution! 🚀

[kilodesodiq-arch]

⚠️ Docs-only PR detected, but encountered merge conflicts because earlier docs merges also touched README.md/SECURITY.md. Leaving for manual rebase — thanks for the contribution! 🙏

[kilodesodiq-arch]

LGTM