docs: standardize Python SDK vulnerability disclosure policy (#3642)

- [x] I understand that this repository is auto-generated and my pull
request may not be merged

## Changes being requested

- Standardize `SECURITY.md` on the shared public SDK policy: **Reporting
a vulnerability**, **What to include**, and **Coordinated disclosure**.
- Use the exact shared warnings against public GitHub issues/pull
requests/discussions and including live credentials, API keys, customer
data, or unredacted sensitive logs.
- Preserve Python's existing coordinated-disclosure URL,
`disclosure@openai.com` contact, authentication-header/private-key
redaction, and respectful disclosure commitment.
- Document the official `openai` PyPI package, published source
distributions/wheels, and relevant package version, Python version,
operating system, impact, and sanitized reproduction details.

## Verification

- CommonMark parsing and exact assertions for the three canonical
headings, three shared report-detail bullets, and all three verbatim
shared warning/disclosure sentences.
- Existing disclosure endpoint returned HTTP 200; disclosure URL/contact
were preserved, and the PyPI URL matches the existing README and actual
`sdist`/wheel build targets.
- Credential-like-literal, line-ending, trailing-whitespace, and
Markdown-link validation.
- `python scripts/check-python-version-policy.py`
- `git diff origin/main...HEAD --check`

## Additional context & links

Only the existing root `SECURITY.md` is changed; no private-reporting
settings, workflows, package code, or unrelated policies are modified.