docs: refresh SECURITY.md and document how to verify the container image #435

What

• A supported versions table
• Point reporters at GitHub private vulnerability reporting, which is enabled
• Remove the advice about secure cookie settings; the API sets no cookies
• .github/ISSUE_TEMPLATE/security_report.yml names seamless-auth-server in the email subject; fix it
• How to verify the published image: the cosign keyless signature, the SBOM and the provenance attestation, with copy-paste commands

Done when

A reporter knows where and how to report, and an operator can verify the image they pull.