Enhance vulnerability reporting guidelines in SECURITY.md

[zbalkan]

Expanded the vulnerability reporting section with recommendations, confidentiality requests, legal authorization for security research, expected timelines, and bug bounty program details.

The main purpose is to provide an OSTIF Guidance compliant policy.

[Copilot]

Pull request overview

Updates SECURITY.md to provide an OSTIF-guidance-aligned vulnerability disclosure policy for Technitium DNS Server, expanding the reporting instructions and setting clearer expectations for researchers and maintainers.

Changes:

• Adds recommended reporting format (email subject, encryption guidance, language preference) and confidentiality expectations.
• Introduces safe-harbor language plus an expected response/remediation timeline and process steps.
• Adds bug bounty stance, a structured report checklist, and an example vulnerability report template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The example report references components that don’t appear to exist in this repository/product (e.g., “Admin Panel” and AdminController.cs line 45). This can confuse reporters and may reduce the usefulness of the guidance. Consider rewriting the example to use product-agnostic placeholders (or DNS Server–relevant endpoints/files) without naming specific non-existent source files/paths.

Suggested change

	Subject: [SECURITY] SQL Injection in Admin Panel
	Impact: SQL Injection leading to authentication bypass
	Affected Versions: v10.0.0 and earlier
	Steps to Reproduce:
	1. Navigate to /admin/login
	2. Enter the following in the username field: ' OR '1'='1
	3. Click login
	4. Observe successful authentication without valid credentials
	Root Cause: User input not sanitized before SQL query construction in AdminController.cs line 45
	Proof of Concept:
	[Code snippet or screenshot]
	Subject: [SECURITY] SQL Injection in login endpoint
	Impact: SQL Injection leading to authentication bypass in the web management interface
	Affected Versions: [List affected version numbers]
	Steps to Reproduce:
	1. Send an HTTP POST request to [LOGIN_ENDPOINT_PATH] (e.g., https://dns-server.example.com/ui/login)
	2. Set the `username` parameter to: ' OR '1'='1
	3. Send the request and observe the response
	4. Observe successful authentication without valid credentials
	Root Cause: User input is not sanitized before SQL query construction in [RELEVANT_SOURCE_FILE] at [RELEVANT_LINE_RANGE]
	Proof of Concept:
	[HTTP request sample, code snippet, or screenshot]