Security reporting: GHSA + reporting-a-vulnerability@keepthewhy.com in SECURITY.md, issue templates, docs

tsk-aw9c35brmf0a done KTW Coder 001 (ktw-coder-001)

Goal

Everywhere the repo tells people how to report a vulnerability, it names the same two private channels (Oliver, 2026-11-04):

GitHub Security Advisories: https://github.com/oliver-zehentleitner/keep-the-why/security/advisories/new (private vulnerability reporting is enabled on the repo)
Email: reporting-a-vulnerability@keepthewhy.com

`SECURITY.md`, "Reporting a Bug":
List both channels.
Say plainly: never as a public issue, discussion or PR.
Fix the "acknowledge your email" wording, which currently follows a GHSA-only instruction, so it fits both channels.
Keep the rest of the policy as it is.
`.github/ISSUE_TEMPLATE/config.yml`: add a first contact_links entry, "Report a security vulnerability", pointing to the advisory URL. Its about text names the email address and says not to open a public issue.
`bug_report.yml`, `feature_request.yml`, `skill_behavior.yml`: one line in the intro markdown block: security issues go to the advisory URL or the email, not here.
`docs/security.md`, "Reporting a vulnerability in Keep the Why itself": name both channels. The page is served on keepthewhy.com.
`README.md`, "Security": check whether the line needs the email. Keep it short and link onward.
Grep the repo for any other place that names a reporting channel (CONTRIBUTING, docs, site), and align it too.

Policy changes such as timelines or the disclosure process. If something there looks wrong, raise it on the card instead of changing it.

Docs/meta only. No package release. The docs page follows the normal site deploy.