doc: mention GitHub private vulnerability reporting in SECURITY.md

[vincenzopalazzo]

Summary

SECURITY.md currently only lists security@blockstream.com as the reporting channel. GitHub private vulnerability reporting is enabled on this repository, but a reporter reading the security policy would never know.

This PR advertises it as the preferred channel, keeping the email as an alternative.

Why

Private vulnerability reporting is strictly better for both sides than email:

• Private by default — the report opens as a draft advisory visible only to the reporter and maintainers (no risk of a public issue with exploit details).
• Single workspace — discussion, fix collaboration (private fork), credit, and coordinated disclosure all happen in one place.
• CVEs built in — maintainers can request a CVE from GitHub directly on the advisory when publishing.
• Better reporter UX — one click from the Security tab, no GPG setup needed.

Changes

The "Reporting a Vulnerability" section now reads:

To report security vulnerabilities, you can either:

• Use GitHub private vulnerability reporting (preferred): click "Report a vulnerability" in the Security tab. ...
• Send an email to security@blockstream.com (GPG key below).

The note that the email address is exclusively for vulnerability reporting is preserved, as is the GPG key table (still needed for the email channel and release signatures).

Changelog-None

[madelinevibes]

I'm going to pause reviewing and confirming this right now. After the onslaught of AI-reported-vulnerabilities, we will review the method to report and then I'll review/amend as we need to.
LOVE the initiative @vincenzopalazzo !