deps: upgrade all dependencies (closes 12 Dependabot alerts) + add SECURITY.md (#784)

* docs: add SECURITY.md with reporting process and incident note

* deps: upgrade all dependencies, closing 12 Dependabot security alerts

Closes all 12 open Dependabot alerts (7 high, 3 moderate, 2 low):

  gitpython   3.1.57 -> 3.1.61   (6 alerts: 5 high, 1 moderate)
  tornado     6.5.7  -> 6.5.8    (3 alerts: 1 high, 1 moderate, 1 low)
  mistune     3.3.0  -> 3.3.4    (1 high)
  setuptools  81.0.0 -> 84.0.0   (1 moderate)
  torch       2.11.0 -> 2.14.0   (1 low)

The gitpython alerts had stayed open even though PR #779 claimed to bump it to
3.1.58. That branch had been force-pushed to the malicious commit 9cb1eab, so
merging it delivered malware instead of the dependency fix (see #781).

Two changes were needed to move torch at all:

  - The CUDA wheel index moves from cu128 to cu130. The cu128 index stops at
    torch 2.11.0, so the vulnerable version could not be fixed on it. This
    raises the NVIDIA driver requirement for users installing the GPU build.

  - torchaudio is removed. Its newest release anywhere is 2.11.0 and it pins
    torch==2.11.0, so it blocks every torch upgrade. Nothing in BindsNET
    imports it; 'grep -rn torchaudio --include=*.py' returns no matches.

The rest of the lock file is a full re-resolve to current versions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: Hananel-Hazan

SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security problems privately rather than in a public issue.
+
+Use GitHub's private reporting form at
+https://github.com/BindsNET/bindsnet/security/advisories/new, or email
+hananel@hazan.org.il.
+
+Please include what you found, how to reproduce it, and which version or commit
+you were on. We aim to acknowledge reports within a few days.
+
+## Supported versions
+
+Security fixes are applied to the `master` branch and to the most recent release
+on PyPI. Older releases are not patched.
+
+## Repository integrity
+
+BindsNET is a research library, and its git history is part of what users rely
+on. The following controls are in place on this repository:
+
+- Force-pushes and branch deletions are blocked on every branch.
+- `master` requires a pull request with an approving review.
+
+A supply-chain incident affecting this repository was reported and remediated in
+September 2026; see issue #781 for the full account. No PyPI release was
+affected. If you cloned this repository between 2026-08-29 and 2026-09-02 and
+opened it in Visual Studio Code, please read that issue.
+
+## What we will never do
+
+BindsNET does not contain, and will never contain, code that runs automatically
+when you open the project in an editor. There are no build hooks, no editor
+tasks that execute on folder open, and no post-install scripts. If you find
+anything of that shape in this repository, treat it as an incident and report it
+using the process above.