Fix dead SECURITY.md links breaking the docs build

docs/operations.md

@@ -205,7 +205,7 @@ manual run), or have a Gardener task start the task with `task.run`. A bot dispa
 A task that declares `task.run` has its caller job granted `actions: write`; `generate` warns about
 it. With that grant the job can also delete workflow runs, logs and artifacts, so for those
 repositories the Worker's `actions_task_audit` table, not the Actions logs, is the durable record. See
-[SECURITY.md](../SECURITY.md#starting-other-tasks).
+[SECURITY.md](https://github.com/scuffi/gardener/blob/main/SECURITY.md#starting-other-tasks).
 
 If apply reports a task run as `dispatch_unknown`, the job fails and Gardener will not dispatch it
 again. Check the target task's workflow runs; if it did not start, start it by hand with

docs/task-reference.md

@@ -247,7 +247,7 @@ effects:
   never dispatches twice: a rerun after `dispatching` settles as `dispatch_unknown` without calling
   GitHub, and the job fails so someone can check whether the task started and run it by hand.
 - The caller job of a task that declares it is granted `actions: write`. See
-  [SECURITY.md](../SECURITY.md#starting-other-tasks) for what else that allows.
+  [SECURITY.md](https://github.com/scuffi/gardener/blob/main/SECURITY.md#starting-other-tasks) for what else that allows.
 - `generate` refuses a target that is not a task of the project, the task itself, a target whose
   workflow takes no input the task can name, a cycle of tasks starting each other, and a pin whose
   apply predates `task.run` (0.1.20 or earlier).