Add a security policy and a private channel to report vulnerabilities #205

The repository has no security policy and no private channel to report a vulnerability: a reporter can only open a public issue.

• Add a SECURITY.md (supported versions, report through the GitHub private vulnerability reporting form).
• notifications.yml: declare permissions: {} (the job only calls a webhook, it does not need the GITHUB_TOKEN).
• Repository settings (done outside the pull request): enable private vulnerability reporting, secret scanning (with push protection) and Dependabot security updates; set the default permissions of the workflows to read (quality.yml and test.yml already declare contents: read).

Found during the global audit after the releases (bridges-audit.md #130).