Move top_up_link out of the public GetStatus endpoint into the
authenticated GetTopUpInfo endpoint. Update classic frontend to
read topup_link from the topup info response instead of status.
Also add mailto links in SECURITY.md.
close#4582
Uncoordinated bulk vulnerability submissions have caused significant
disruption. Added a prominent notice requiring prior coordination for
bulk reports, with clear consequences: closure without review and
potential blocking of repeated offenders.
