docs: add docs/README index linking the security audits

Adds a root docs/README.md pointing to the dependency vulnerability audit
(docs/security/) and the in-package crypto audit (packages/crypto/AUDIT.md),
so both are discoverable from one place without moving the crypto audit out
of its package (keeps its README link valid on npm).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rhyslbw

docs/README.md

@@ -0,0 +1,14 @@
+# Documentation
+
+Tracked, human-authored documentation for the Cardano JS SDK. (Generated API
+reference is produced by TypeDoc into `typedoc/` and published separately.)
+
+## Security
+
+- [Dependency vulnerability audit (2026-06-19)](./security/dependency-vulnerability-audit-2026-06-19.md) —
+  point-in-time audit of the dependency remediation: per-dependency vulnerability status,
+  blast radius across SDK packages, and supply-chain provenance.
+- [Crypto package security audit (Nov 2023)](../packages/crypto/AUDIT.md) —
+  third-party audit of the `@cardano-sdk/crypto` libsodium implementation
+  ([PDF report](../packages/crypto/audit_202311.pdf)). Kept inside the package so its
+  link remains valid when the README is rendered on npm.