master
ci: scope GITHUB_TOKEN to minimum required permissions
Add security policy for vulnerability reporting