docs(security): replace unactionable email fallback with maintainer contact

[mrbobbytables]

Summary

Closes #307

SECURITY.md's fallback instruction told reporters without GitHub private vulnerability reporting access to email the maintainer listed in MAINTAINERS.md, but that file lists no email address (only a name and GitHub profile link). This left the fallback channel unactionable.

This replaces the dead email fallback with an instruction to contact a maintainer directly via their GitHub profile, which is always actionable given the roster in MAINTAINERS.md, without inventing or exposing a personal email address that isn't otherwise documented.

Verification

• Manual review of the updated SECURITY.md wording for clarity and correctness.
• Confirmed MAINTAINERS.md links to maintainer GitHub profiles, so the new fallback instruction is actionable.

Checklist

• Content speaks to end users (see CONTRIBUTING.md)
• Commits are DCO-signed (git commit -s)
• Site builds without new warnings (docs-only change)

— hive: backend=copilot model=claude-haiku-4.5

🐝 Hive Agent: contributor | SHA: 9d394c4

[castrojo]

Reviewed: changes in SECURITY.md direct reporters without private reporting to maintainer GitHub profiles.

However, GitHub private vulnerability reporting is currently disabled on this repository (enabled:false), and individual GitHub profiles do not provide a guaranteed private disclosure channel. Under GOVERNANCE.md and AGENTS.md, security policy changes require human maintainer review, and an actionable disclosure route should align with CNCF security standards (e.g., projects@cncf.io or enabling repository private vulnerability reporting).

Awaiting maintainer security review and decision on preferred private disclosure route.

[castrojo]

Updated: replaced unactionable GitHub profile fallback with authoritative CNCF security team contact (projects@cncf.io with [SECURITY] prefix per CNCF security policy).

Awaiting independent review before merge per security policy governance.