docs(security): make SECURITY.md a standing document

SECURITY.md was a standing document that named facts a release moves. It carried 45 transitive module versions, scanner names with their versions and finding counts, eleven advisory identifiers, and the busybox, buildkit and grpc versions. A one-line Renovate bump of google.golang.org/grpc left the module measurements wrong within hours of merging, and no job in the pipeline could catch that.

Every posture claim now states its mechanism in a sentence or two and names the file that owns the current value: go-overrides.txt for override versions, security/vex/statements.json and the OpenVEX attestation for advisories and their triage, the SBOM attestation for what shipped, Dockerfile.debug for the busybox pin, .gitlab-ci.yml for the toolchain and GOFIPS140_VERSION pins, CHANGELOG.md for history. The CMVP and CAVP certificate numbers stay, with the sentence that says which pin moves them. Two duplicates go: the variants table is the README's, and the verification section now carries only what the README lacks, which is reading the three attestations. The policy sections keep their substance and the reference project's shape.

CONTRIBUTING's ## Where a fact goes gains that rule. The busybox runbook stops quoting a version and stops sending a contributor to four prose copies, since Dockerfile.debug owns the pin and the CHANGELOG entry is the only prose copy left.

SECURITY.md is 2342 words against 4726, with no section over 250.

Checks: check-versions.sh exits 0, and SECURITY.md keeps the one chainguard-forks/kaniko/blob/vX.Y.Z source link that check 2c requires and set-release.sh rewrites; it carries no release-tag pin, as before. Vale alerts down from five to one, and the one left predates this branch. Every README and CONTRIBUTING anchor into SECURITY.md still resolves.