Update security reporting policy

[sony-mathew]

Summary

• Clarify security report quality expectations, duplicate handling, and canonical earliest-report policy.
• Document when Chatwoot requests/publishes CVEs and when duplicate, theoretical, scanner-only, upstream dependency, or hardening-only items do not get new CVEs.
• Pin docs Node version to 22.22.2 and make the broken-link workflow use .nvmrc via actions/setup-node.

Validation

• git diff --check
• nvm use v22.22.2 && node -v && npm -v
• PUPPETEER_SKIP_DOWNLOAD=true npm_config_cache=/tmp/npm-cache-node-22-22-2 npx --yes mint@latest broken-links