docs: add private security reporting exception

Route suspected vulnerabilities and embargoed fixes through GitHub Security Advisories instead of the public issue-first flow. Limit public issue content to redacted, non-sensitive impact, and keep the issue and Closes exemption scoped to fixes coordinated privately until disclosure is approved.

Also permit a direct broken-link correction to replace only the target of that existing link. All other URL target changes continue to require an approved issue.

Verified the repository private vulnerability reporting setting is enabled, the Markdown advisory link is valid, and the staged documentation diff passes git diff --check and credential scanning.