Document private vulnerability reporting and enable weekly npm/Cargo dependency update PRs; link CONTRIBUTING to the new security policy.