Add a security policy documenting the .yo-rc.json trust model

Overview of the feature request

There is no SECURITY.md in the repository. Beyond the reporting process, we should document the trust model of the generator's configuration, which is not obvious to users:

.yo-rc.json (and .jhipster/*.json entity configs and JDL) is generator input, not inert data — its properties become part of the generated application, and blueprints/generators entries are npm packages that get installed and executed. So running the generator on a configuration you did not author is equivalent to running its author's code.

Proposed SECURITY.md:

• How to report a vulnerability privately.
• The trust model: why config is trust-sensitive, and a per-scenario table (own config, trusted clone, untrusted public repo, PR review).
• Recommendations for users and for CI/hosted generation (sandboxing, incl. the Node.js permission model; --disable-blueprints; validating every config file against), noting that running JHipster as a hosted service on other people's configurations is not an officially supported use case.

Motivation for or Use Case

Related issues or PR

• Checking this box is mandatory (this is just to show you read everything)