chore: add SECURITY.md and Dependabot config

Add a private vulnerability-reporting policy and weekly Dependabot updates
(npm/cargo as applicable + GitHub Actions) to satisfy the org security-posture
baseline.

Refs Heretek-Games/drop#69

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues **privately** using GitHub's private
+vulnerability reporting on this repository (**Security → Report a
+vulnerability**). Do not open a public issue for a security problem.
+
+Include a description, the affected version or commit, reproduction steps, and
+the impact. We aim to acknowledge reports within a few business days.
+
+## Scope
+
+This repository is part of the [Heretek Games](https://github.com/Heretek-Games)
+workspace. See [`drop`'s SECURITY.md](https://github.com/Heretek-Games/drop/blob/develop/SECURITY.md)
+for the platform-wide policy.