Address "Network Access" Supply Chain Risk

[Josephat-S]

What to build

Socket flagged 2 packages that access the network. This is expected behavior for our CLI (we fetch templates from GitHub), but we should document which packages make network requests and ensure no unexpected outbound connections exist.

Steps to resolve

1. The network access is from tiged (or its replacement) fetching templates — this is intentional.
2. Document in the README or a SECURITY.md file that the CLI makes outbound requests to GitHub only.
3. Ensure no other dependency makes unexpected network calls.

Acceptance criteria

• Create a SECURITY.md documenting what network requests the CLI makes and why.
• Verify no dependency phones home to analytics/telemetry services.
• Add a --offline note in docs explaining the CLI requires internet for production mode.

[Josephat-S]

This issue was solved in #84