Ship LICENSE.md in package and add SECURITY.md

[omgovich]

Summary

• Add LICENSE.md to the files array in package.json so it's explicitly included in the published tarball — helps SBOM tooling detect the license. Closes Missing LICENSE.md file on shipped package #128.
• Add SECURITY.md pointing to GitHub's private vulnerability reporting form for responsible disclosure. Closes Create SECURITY.md #108.

Test plan

• npm pack --dry-run lists LICENSE.md in the tarball contents
• SECURITY.md renders on the repo's Security tab and the "Report a vulnerability" link resolves

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR improves package/distribution metadata and security reporting guidance by ensuring the project’s license file is explicitly included in the published npm tarball and by adding a GitHub-native security policy document.

Changes:

• Add LICENSE.md to package.json#files so it’s included in the published package (improves SBOM/license detection).
• Add SECURITY.md with instructions to report vulnerabilities via GitHub private vulnerability reporting.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
SECURITY.md	Adds a security policy and private vulnerability reporting link.
package.json	Explicitly includes LICENSE.md in the npm publish whitelist.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (62b32e1) to head (0588955).

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #133   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           41        41           
  Lines          622       622           
  Branches       115       140   +25     
=========================================
  Hits           622       622           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Size Change: 0 B

Total Size: 11.5 kB

ℹ️ View Unchanged

Filename	Size
dist/index.js	2.09 kB
dist/plugins/a11y.js	463 B
dist/plugins/cmyk.js	717 B
dist/plugins/harmonies.js	231 B
dist/plugins/hwb.js	897 B
dist/plugins/lab.js	1.55 kB
dist/plugins/lch.js	1.44 kB
dist/plugins/minify.js	632 B
dist/plugins/mix.js	1.07 kB
dist/plugins/names.js	1.54 kB
dist/plugins/xyz.js	839 B

_{compressed-size-action}