docs(security): route reports through private advisories (#6728)

Routes security researchers to GitHub's private vulnerability reporting
workflow instead of a public issue or email-first disclosure.

- Makes the private advisory form the primary path in `SECURITY.md`,
with email retained as a fallback.
- Adds private-reporting links to the contributor guide, issue chooser,
and bug template.

Checked with `git diff --check`, Ruby YAML parsing, and confirmation
that private vulnerability reporting is enabled for `block/buzz`.

Signed-off-by: Jordan Mecom <jm@squareup.com>

.github/ISSUE_TEMPLATE/bug-report.md

@@ -4,6 +4,10 @@ about: Report a reproducible bug in Buzz
 labels: bug
 ---
 
+> [!IMPORTANT]
+> Do not include security vulnerabilities in a public issue. [Report them
+> privately through a GitHub security advisory](https://github.com/block/buzz/security/advisories/new).
+
 **Describe the bug**
 A clear and concise description of what the bug is.
 

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +1,5 @@
 blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/block/buzz/security/advisories/new
+    about: Report security vulnerabilities privately to the Buzz maintainers.