docs: update security reporting instructions (#19364)

## Background

The security policy currently directs vulnerability reports to an
unmonitored email address. The supported disclosure channel for AI SDK
is Vercel's Open Source HackerOne program.

## Summary

- replace the security email instructions with a direct link to the
Vercel Open Source HackerOne program

## Checklist

- [x] All commits are signed (PRs with unsigned commits cannot be
merged)
- [ ] Tests have been added / updated (for bug fixes / features)
- [x] Documentation has been added / updated (for bug fixes / features)
- [ ] A _patch_ changeset for relevant packages has been added (for bug
fixes / features - run pnpm changeset in the project root)
- [x] I have reviewed this pull request (self-review)