docs: support nostream 3.5+ only and name a private reporting route

[Priyanshubhartistm]

Description

Replaces the unedited GitHub template in SECURITY.md:

• Supported versions: security fixes land on nostream 3.5 and newer only (current line 3.6.x, 3.6.1 at time of writing). 3.0-3.4, 2.x and 1.x are listed as unsupported, with no advisories, backports or patches.
• Reporting: GitHub private advisories (https://github.com/cameri/nostream/security/advisories/new) instead of a public issue, with what to include and what happens after.
• rewrite/main (Rust): stated explicitly as covered as it ships, since it has no release yet.

Related Issue

Closes #886

[changeset-bot]

🦋 Changeset detected

Latest commit: 53cb900

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[greptile-apps]

Confidence Score: 5/5

[Low impact] This documentation-only PR appears safe to merge.

Summary

Replaces the security-policy template with concrete support and reporting guidance.

• nostream security fixes cover 3.5 and newer, including the Rust rewrite.
• Security reports go to GitHub’s private advisory form.

_{Reviews (3) · Last reviewed commit: "Merge branch 'main' into docs/security-p..." · Reviewed by Greptile}

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.