Update security policy for private vulnerability reporting

The policy gave security@hyperledger.org as the email intake and linked
to Defect Response on the retired Hyperledger wiki. It also pointed at
the security advisories index rather than the form used to open a report.

Rewrite it along the lines of the policy already in fabric-gateway:

- Align with the LF Decentralized Trust security vulnerability disclosure
  policy and link to it as the governing document.
- Lead with GitHub private vulnerability reporting, linking to the new
  advisory form for this repository, and state plainly that issues,
  discussions, and pull requests are not the place for a report.
- Give security@lists.lfdecentralizedtrust.org as the email intake, which
  LF Decentralized Trust requires every project to accept.
- Describe what a useful report contains, what a reporter should expect
  in return including the two business day acknowledgement the governing
  policy sets, and how vulnerabilities in dependencies are handled.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Ry Jones <ry@linux.com>

Author: ryjones

SECURITY.md

@@ -1,12 +1,49 @@
-# Hyperledger Security Policy
+# Security Policy
 
-## Reporting a Security Bug
+This document defines how security vulnerability reporting is handled for Hyperledger Fabric. The
+approach aligns with the
+[LF Decentralized Trust security policy](https://lf-decentralized-trust.github.io/governance/governing-documents/security).
+Please review that document to understand the basis of security reporting for this project. Details
+specific to this repository are documented below.
 
-If you think you have discovered a security issue in any of the Hyperledger projects, we'd love to hear from you. We will take all security bugs seriously and if confirmed upon investigation we will patch it within a reasonable amount of time and release a public security bulletin discussing the impact and credit the discoverer.
+## Reporting a vulnerability
 
-There are two ways to report a security bug. The easiest is to email a description of the flaw and any related information (e.g. reproduction steps, version) to [security at hyperledger dot org](mailto:security@hyperledger.org).
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull
+requests.**
 
-The other way is to file a confidential security bug in the repository's [security advisories page](https://github.com/hyperledger/fabric/security/advisories). Guidance can be found in the GitHub documentation on [privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).
+Suspected security vulnerabilities in this project can be reported privately using the repository's
+[security advisories page](https://github.com/hyperledger/fabric/security/advisories/new). Guidance
+can be found in the GitHub documentation on
+[privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).
 
-The process by which the Hyperledger Security Team handles security bugs is documented further in our [Defect Response page](https://lf-hyperledger.atlassian.net/wiki/spaces/SEC/pages/20283618/Defect+Response) on our [wiki](https://lf-hyperledger.atlassian.net/wiki).
+Reports are also always accepted by email to the LF Decentralized Trust security list,
+[security@lists.lfdecentralizedtrust.org](mailto:security@lists.lfdecentralizedtrust.org). Include
+the name of the project or repository along with the details listed below. If triage determines the
+issue is a security vulnerability, the security team will open a GitHub security advisory for it.
 
+### What to include
+
+The more detail you can give us, the faster we can confirm and fix the issue. Where possible,
+please include:
+
+- The affected version, commit, or release.
+- A description of the vulnerability and its potential impact.
+- Step-by-step instructions to reproduce it, including any proof-of-concept code.
+- Your assessment of the severity, and any suggested mitigation or fix.
+- How you would like to be credited in the advisory, if the issue is confirmed.
+
+## What to expect
+
+- We will acknowledge receipt of your report within 2 business days.
+- The maintainers will work with you to confirm the vulnerability and keep you updated on progress.
+- We will coordinate a fix and a public security bulletin with you, and credit you as the
+  discoverer unless you ask us not to.
+
+Please keep the details of the issue confidential until an advisory has been published, so that
+users have a chance to update.
+
+## Vulnerabilities in dependencies
+
+Dependencies are regularly scanned for published security vulnerabilities, and these are addressed
+as soon as practical. In general it should not be necessary to report vulnerabilities in project
+dependencies.