docs(security): route reports through private advisories (#6728)

Routes security researchers to GitHub's private vulnerability reporting
workflow instead of a public issue or email-first disclosure.

- Makes the private advisory form the primary path in `SECURITY.md`,
with email retained as a fallback.
- Adds private-reporting links to the contributor guide, issue chooser,
and bug template.

Checked with `git diff --check`, Ruby YAML parsing, and confirmation
that private vulnerability reporting is enabled for `block/buzz`.

Signed-off-by: Jordan Mecom <jm@squareup.com>

CONTRIBUTING.md

@@ -6,6 +6,10 @@ get from zero to a merged pull request.
 
 If you have questions that aren't answered here, [open an issue](https://github.com/block/buzz/issues/new).
 
+If you believe you found a security vulnerability, do not open a public issue.
+Follow our [security policy](SECURITY.md) to submit a private vulnerability
+report instead.
+
 ---
 
 ## Table of Contents