Enable private vulnerability reporting and streamline security policy

[Widthdom]

CLOSES #223

Summary

• Enabled GitHub private vulnerability reporting for the repository and verified the setting through the GitHub API.
• Reorganized SECURITY.md into one complete English section and one equivalent Japanese section.
• Documented supported versions, the direct private-reporting path, required report details, response targets, coordinated disclosure, and the preserved threat model.
• Corrected Japanese SECURITY.md anchors in the README and developer guide.
• Added regression coverage and synchronized the English/Japanese changelog entries.

Root cause

Private vulnerability reporting was disabled, while the security policy split reporting guidance and the threat model across duplicated English/Japanese sections. The fallback also directed reporters toward public Issues, and two Japanese documentation links targeted stale anchors.

Acceptance criteria

• Reporters can submit privately through GitHub private vulnerability reporting.
• SECURITY.md links directly to the private reporting form.
• English and Japanese reporting instructions are complete and equivalent.
• Duplicate policy text is removed while supported-version information and the full threat model remain.
• Public Issues are explicitly excluded as the vulnerability-reporting channel.
• Each language section explains the reporting and disclosure process in one pass.

Impact

This is a repository-setting, documentation, and regression-test change. It does not alter nildiff runtime behavior.

Verification

• GitHub API reports private vulnerability reporting as enabled: true.
• Focused SecurityPolicy_UsesPrivateReportingAndCompleteBilingualSections test: passed.
• Release test suite: 2,043 passed, 1 expected skip.
• dotnet format FolderDiffIL4DotNet.sln --verify-no-changes --no-restore --verbosity minimal: passed.
• git diff origin/main..HEAD --check: passed.
• cdidx searches confirm no stale SECURITY.md#japanese or SECURITY.md#セキュリティ links remain.
• Adversarial review completed with no remaining actionable findings.