docs: add security policy

[WilliamBergamin]

Summary

• Adds a SECURITY.md to .github/ with vulnerability reporting instructions, threat model, and disclosure policy
• Directs reporters to the Slack HackerOne bug bounty program
• Defines in-scope vulnerabilities (signature bypass, token leakage, DoS, auth bypass) and out-of-scope issues

closes: #1503

Category

• slack_bolt.App and/or its core components
• slack_bolt.async_app.AsyncApp and/or its core components
• Adapters in slack_bolt.adapter
• Document pages under /docs
• Others

Requirements

Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've run ./scripts/install_all_and_run_tests.sh after making the changes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.30%. Comparing base (92d8516) to head (9a8318f).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1511   +/-   ##
=======================================
  Coverage   91.30%   91.30%           
=======================================
  Files         228      228           
  Lines        7271     7271           
=======================================
  Hits         6639     6639           
  Misses        632      632           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[srtaalej]

⭐ ⭐ ⭐

[zimeg]

@WilliamBergamin Awesome writings that I hope aren't read most often 😉 🔏

[zimeg]

🐍 ✨ praise: Adjacent improvements for better packages so much appreciated!