Migrate residual URLs and security-report path to Forge

Cleanup pass after the v1.4.3 cutover. Five files still carried
gitea.com hosts or dead github.com security-advisory links because
they were not touched in the prior URL sweep.

- forge-announce.yml: Discord embed avatar and tag link
- release-footer.md: custom-repo URL plus six doc/license links
- bug_report.yml, config.yml, PULL_REQUEST_TEMPLATE.md: replace
  github.com/.../security/advisories/new with mailto:kontakt@
  hellion-media.de. Gitea has no privately-reportable advisory
  feature; e-mail is the closest functional equivalent.

Pure string replacement, no logic change.

.github/workflows/forge-announce.yml

@@ -133,7 +133,7 @@ jobs:
           # ---------- Embed-Payload bauen ----------
           $payload = [ordered]@{
               username = "Forge Herald"
-              avatar_url = "https://gitea.com/JonKazama-Hellion/HellionChat/raw/branch/main/HellionChat/images/icon.png"
+              avatar_url = "https://gitea.hellion-forge.cloud/JonKazama-Hellion/HellionChat/raw/branch/main/HellionChat/images/icon.png"
               content = "<@&1500489631555260446>"
               allowed_mentions = [ordered]@{
                   parse = @()
@@ -142,7 +142,7 @@ jobs:
               embeds = @(
                   [ordered]@{
                       title = $title
-                      url = "https://gitea.com/JonKazama-Hellion/HellionChat/releases/tag/$tag"
+                      url = "https://gitea.hellion-forge.cloud/JonKazama-Hellion/HellionChat/releases/tag/$tag"
                       color = 12730636
                       description = $description
                       footer = [ordered]@{ text = $footerText }