Add rshell security disclosure policy

[astuyve]

What does this PR do?

Adds SECURITY.md with Datadog's private vulnerability reporting path for rshell and explains where public advisories are published after coordinated disclosure.

Motivation

rshell is a customer-installable artifact, so reporters need a clear, private process for vulnerability reports rather than sharing details in public issues, discussions, or pull requests. The policy follows the same preferred pattern used by dd-trace-go: report vulnerabilities to security@datadoghq.com and use GitHub Security Advisories for public disclosure history when appropriate.

Testing

• Ran make fmt.
• Ran git diff --check.
• Verified SECURITY.md includes the private reporting address, public-disclosure warning, supported-version guidance, and GitHub Security Advisory publication note.

Changes

• Added root SECURITY.md.
• Directed vulnerability reports to security@datadoghq.com.
• Documented that public vulnerability history is published through GitHub Security Advisories when appropriate.

Checklist

• Tests added/updated
• Documentation updated (if applicable)

---

PR by Bits - View session in Datadog

Comment @DataDog to request changes

[datadog-prod-us1-3]

View session in Datadog

Bits Code status: ✅ Done

Comment @DataDog to request changes

[datadog-official]

I can only run on private repositories.