docs(governance): add security posture report cadence and publication…

[Johnsource-hub]

closes #1828

Changes

• Add Governance/reporting/SECURITY_POSTURE_REPORT.md — documents the
  metrics disclosed (vulnerability/dependency health, secret rotation
  compliance, access control, incident/postmortem metrics, CI security
  gates, certificate health), the report cadence (quarterly, annual,
  ad-hoc), the audience and delivery rules, the canonical publication
  location, and the ownership/correction process.
• Update Governance/README.md — adds a Reporting section linking the
  new document so it is discoverable from the top-level governance index.

Scope

• 2 files changed, both inside Governance/
• No application code touched
• No existing tests affected

[drips-wave]

@Johnsource-hub Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project