Routes security researchers to GitHub's private vulnerability reporting
workflow instead of a public issue or email-first disclosure.
- Makes the private advisory form the primary path in `SECURITY.md`,
with email retained as a fallback.
- Adds private-reporting links to the contributor guide, issue chooser,
and bug template.
Checked with `git diff --check`, Ruby YAML parsing, and confirmation
that private vulnerability reporting is enabled for `block/buzz`.
Signed-off-by: Jordan Mecom <jm@squareup.com>
Removes the promise in `SECURITY.md` to publish a GitHub Security
Advisory after every security fix is released.
The disclosure policy continues to state that Buzz follows coordinated
disclosure and credits reporters unless they request anonymity.
Checked with `git diff --check`.
Signed-off-by: Jordan Mecom <jm@squareup.com>
