v1.10.2 patches: continent persistence, city markers, dynamic map center

C changes:
- gstorage.c: encode continent into root key for --persist --restore survival
- gholder.c: decode continent from root + lat/lng storage
- commons.h: add lat/lng fields to GMetrics struct
- geoip2.c/geoip1.h: extract coordinates from MMDB
- json.c: output lat/lng in geolocation JSON

JS changes:
- Remove cityIndex guard for static HTML city dots
- TopoJSON lat/lng fallback for city coordinates
- updateMap fallback city collection
- Dynamic orthographic center based on visitor count
- Mercator stays at [0,15] for full world view

Co-Authored-By: Claude <noreply@anthropic.com>

SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+Found a security issue in [GoAccess](https://github.com/allinurl/goaccess)?
+Read on.
+
+## Reporting a Vulnerability
+
+GoAccess takes all security bugs seriously. Thank you for improving the
+security of `goaccess`. I appreciate your efforts and responsible disclosure
+and will make every effort to acknowledge your contributions.
+
+Vulnerabilities should be reported to [hello@goaccess.io](mailto:hello@goaccess.io) which is a private,
+maintainer-only email address.
+
+
+When I receive a security bug report, I will work on the fix and prepare a
+release including the following steps:
+
+  * Confirm the problem and determine the affected versions.
+  * Audit the code to find any potential similar problems.
+
+## Comments on this Policy
+
+If you have suggestions on how this process could be improved please submit a
+pull request.
+
+When reporting an issue, where possible, please provide the following (if
+possible):
+
+* Commit version where the issue was introduced.
+* A proof of concept (plaintext; or ideally send a patch to same email address)
+* Steps to reproduce
+* Your recommended fixes, if any.
+
+> Note: Please do not open public issues for security issues, as GitHub does
+> not provide facility for private issues, and deleting the issue makes it hard
+> to triage/respond back to the reporter.