security: SECURITY.md's private disclosure channels are both unreachable

[kai392]

SECURITY.md says "Do not open a public issue" and offers two private
channels. neither is reachable right now, so a reporter who follows the policy
has nowhere to go.

1. github security advisories (listed as preferred) —
   https://github.com/plind-junior/vouch/security/advisories/new. that path
   resolves to vouchdev/vouch, and private vulnerability reporting is off:

   POST /repos/vouchdev/vouch/security-advisories/reports
   403  {"message": "Repository does not have private vulnerability reporting enabled"}
   

   same response for the plind-junior/vouch spelling, since it redirects
   here.

2. email — security@vouch.invalid. SECURITY.md labels it a placeholder,
   and .invalid is reserved by rfc 2606 precisely so it never resolves, so
   nothing sent there can be delivered.

the fix is a checkbox: settings → code security → private vulnerability
reporting → enable. that turns the "report a vulnerability" button on for the
advisory url SECURITY.md already points at. worth updating the link to the
vouchdev/vouch spelling and replacing the placeholder address with a real
one (or dropping option 2) at the same time.

this issue deliberately carries no vulnerability details — it is only about the
channel. i am sitting on a finding i would like to report the moment there is
somewhere private to send it; it is not in this issue, in a pr, or in a commit.
if you would rather not enable the github feature, name any private route you
prefer and i will use that instead.