Add what a public repository is asked for: security policy, templates, CI matrix

[ExaltedTrou6]

Nothing here changes the SDK. It is the paperwork a repository needs once
strangers can open issues against it.

SECURITY.md routes vulnerability reports to GitHub's private advisory flow
instead of a public issue, and names what counts as one here: a secret
reaching a log or an error string (a webhook path is full access to a portal), a
way past the application_token check or the DOMAIN validation,
client_secret escaping the oauth package. It also names what does not, so
ACCESS_DENIED from a portal does not arrive as a security report.

⚠️ It points at GitHub Security Advisories only. If Bitrix24 has an official
address for vulnerability reports, add it — I deliberately did not invent one.

Issue templates carry the two warnings that would otherwise be learned the
hard way: do not paste a webhook URL into a public issue, and per-method
wrappers are not something this SDK adds — every method is callable by name
already. The feature template asks for the workaround code, because that is the
evidence a gap is real; the whole of v0.2 was found exactly that way.

A PR template with the four CI checks and a reminder that tests here explain
why they exist and assert behaviour rather than shape.

CI now runs twice: the minimum Go from go.mod, which is what someone on an
older toolchain actually builds with, and stable, where a new vet check or a
changed stdlib default lands first. The minimum is read from go.mod rather
than repeated as a literal, so the two cannot drift.

Note: the matrix relies on setup-go falling back to go-version-file when
go-version is empty. YAML is valid, but this is the one thing I could not
execute locally — the first CI run on this PR is the proof.

Merges cleanly with #15 in either order; CI checked on the combined result.

🤖 Generated with Claude Code