Migrate residual URLs and security-report path to Forge

Cleanup pass after the v1.4.3 cutover. Five files still carried
gitea.com hosts or dead github.com security-advisory links because
they were not touched in the prior URL sweep.

- forge-announce.yml: Discord embed avatar and tag link
- release-footer.md: custom-repo URL plus six doc/license links
- bug_report.yml, config.yml, PULL_REQUEST_TEMPLATE.md: replace
  github.com/.../security/advisories/new with mailto:kontakt@
  hellion-media.de. Gitea has no privately-reportable advisory
  feature; e-mail is the closest functional equivalent.

Pure string replacement, no logic change.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -8,7 +8,7 @@ body:
       value: |
         Thanks for reporting. Please fill in the fields below so I can
         reproduce the issue. If this is a security issue, stop here and
-        use the [private vulnerability advisory](https://github.com/JonKazama-Hellion/HellionChat/security/advisories/new)
+        report it privately to [kontakt@hellion-media.de](mailto:kontakt@hellion-media.de?subject=%5BHellionChat%20Security%5D)
         instead.
 
   - type: input

.github/ISSUE_TEMPLATE/config.yml

@@ -2,8 +2,8 @@ blank_issues_enabled: false
 
 contact_links:
   - name: Security vulnerability
-    url: https://github.com/JonKazama-Hellion/HellionChat/security/advisories/new
-    about: Do not open a public issue for security problems. Use the private advisory instead.
+    url: mailto:kontakt@hellion-media.de?subject=%5BHellionChat%20Security%5D
+    about: Do not open a public issue for security problems. Report by e-mail instead.
 
   - name: Upstream Chat 2 issue
     url: https://github.com/Infiziert90/ChatTwo/issues