[INFOSEC-634] Add security policy

[bhargavirao24]

Description

Adds a SECURITY.md file so security researchers have clear instructions for privately reporting vulnerabilities in eigenlayer-metadata.

The policy:

• directs vulnerability reports to security@bitgo.com
• explains what information to include in a report
• provides guidance for securely sharing sensitive material
• clarifies that Bugcrowd eligibility depends on the program scope
• requests coordinated disclosure

Testing

Not applicable. This is a documentation-only change.

Tracking

INFOSEC-634: Publish SECURITY.md for public repositories

[linear-code]

INFOSEC-634

[bhargavirao24]

Closing this PR for now since this repository is being considered for archival.
I am discussing with the relevant team whether it should be archived and made private. If we decide to keep it public and active, we can reopen this PR and add the SECURITY.md. Ty!