docs(contributing): point vulnerability reports at the organization's security policy

[fylorn]

What this changes

The last paragraph of CONTRIBUTING.md's "Security-relevant changes" section now links the organization's security policy (SECURITY.md in ThinkWatchProject/.github) instead of "SECURITY.md if present, or contact the maintainer directly", and it asks contributors not to describe a vulnerability in a public issue, PR, commit or comment.

Why

• This repository has no SECURITY.md of its own, so the relative link was dead, and "contact the maintainer directly" gave no address to write to.
• docs: default issue forms and a security policy for the organization .github#8 adds an organization-wide SECURITY.md, which GitHub applies to every repository in the organization without its own. While private vulnerability reporting is off, that policy asks for one public issue: a "Security contact request" with an empty body, answered with a draft security advisory. "Don't open a public issue" would contradict it; "don't describe a vulnerability in public" matches its wording.

How it was verified

• Only this repository mentioned a security contact: git grep on dev finds no other reference to SECURITY.md or to contacting a maintainer, and the Lite and Core CONTRIBUTING.md files have no such paragraph.
• The link target does not exist yet: https://github.com/ThinkWatchProject/.github/blob/main/SECURITY.md returns 404 until docs: default issue forms and a security policy for the organization .github#8 is merged, and https://github.com/ThinkWatchProject/ThinkWatch/security/policy shows "No security policy detected" today. The link names the file in the .github repository rather than this repository's Security › Policy page because the page can only be checked once the organization default is live.

Notes for review

• Merge after docs: default issue forms and a security policy for the organization .github#8, so that the link resolves.
• Once Request for Collaboration Quotation #8 is merged and https://github.com/ThinkWatchProject/ThinkWatch/security/policy shows the organization policy, the link could point there instead; either reaches the same file.

🤖 Generated with Claude Code