[php-src] PR #25146: Make SECURITY.md the complete vulnerability disclosure policy

Pull Request: https://github.com/php/php-src/pull/25146 Author: bukka The policy was previously split between SECURITY.md and security-classification.rst in the php/policies repository, with part of the content duplicated. The policies repository is not a good place for it: it is managed by the security team and changes there require an RFC. The document there was also outdated and no longer reflected what is currently being done, in particular the use of CVSS v4 instead of the custom severity classes and the handling of all issues through GitHub security advisories and the private security repository. This moves everything still relevant into SECURITY.md so that it can replace the policies document. The plan is to then remove the content from php/policies and keep only a short file pointing to SECURITY.md.