[jplgarcia]

Adds a default SECURITY.md for the Cartesi repositories that do not have their own, so GitHub shows a "Security policy" link on each of them. It also links the policy from the organization profile README, in "Explore and contribute".

• Reports go privately by email to rollups@cartesi.foundation, never in public issues, PRs or discussions.
• No response-time or disclosure-date commitments, on purpose.
• Points to the Audit Reports page of the docs, which holds the same policy and will list advisories (docs(get-started): add audit reports page docs#357).
• The file stays at the repo root because GitHub only uses it as the organization default from the root, .github/ or docs/, not from profile/.
• The profile link is relative (../SECURITY.md), like the Engineering map link. How the org page resolves the ../ can only be confirmed after merge.

Do not merge before the rollups@cartesi.foundation mailbox exists. A ticket for it is already open.

Reports are not encrypted for now. If the team later adopts PGP, a security.txt with the keys can be added.

🤖 Generated with Claude Code