chore: ship LICENSE.md in package and add SECURITY.md

- Add LICENSE.md to the package.json `files` array so SBOM tooling can
  detect the license in the published tarball (closes #128).
- Add SECURITY.md pointing to GitHub's private vulnerability reporting
  form for responsible disclosure (closes #108).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: omgovich

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities privately through GitHub's [private vulnerability reporting](https://github.com/omgovich/colord/security/advisories/new) form.
+
+Include:
+
+- A description of the issue and its potential impact
+- Steps to reproduce, a proof of concept, or a code snippet
+- The affected version(s) of colord
+
+Please do not open public GitHub issues for security vulnerabilities.
+
+## Supported Versions
+
+Security fixes are applied to the latest released version on the `master` branch.

package.json

@@ -100,7 +100,8 @@
   },
   "files": [
     "*.{js,mjs,ts,map}",
-    "plugins/*.{js,mjs,ts,map}"
+    "plugins/*.{js,mjs,ts,map}",
+    "LICENSE.md"
   ],
   "types": "index.d.ts",
   "scripts": {