docs: land the support horizon on main (recovers #11) - #14

SECURITY.md said which line receives fixes and that older majors are
dropped, but not for how long the current line lives or how its end would
be signalled — the two things a downstream consumer doing CRA-era supplier
due diligence asks for after "do you have a disclosure channel".

The horizon is tied to what the packages target: .NET 10 (and EF Core 10
for the EF Core packages), maintained while Microsoft supports that .NET
release (LTS, November 2028) or until a new major supersedes it — with the
note that majors here are cheap and a new one has never meant the old one
lost fixes before its successor shipped. No fixed date, no SLA — an
intention, phrased as one, with the promise that a change is recorded
there first. A second paragraph names the single-maintainer risk plainly,
says what "unmaintained" would look like, and that forking is the intended
continuity mechanism. A third says how advisories reach consumers'
tooling: GitHub Security Advisories → GitHub Advisory Database → NuGetAudit
on restore.

The .NET major in the horizon sentence is anchored to the core project's
TargetFramework by SecurityPolicyConventionTests, so moving to net11.0
without moving the sentence fails the build.

Verified: the new test passes as written, fails with the sentence saying
.NET 11, fails with the anchor phrase reworded, passes restored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>