[5.x] Mention the demo site as another install you should not use to …

…test security. (#10578)

Mention the demo site too.

SECURITY.md

@@ -9,7 +9,7 @@ While working to identify potential security vulnerabilities in Statamic, we ask
 - Provide a quality report with precise explanations and concrete attack scenarios.
 
 ## Scope
-We are only interested in vulnerabilities that affect Statamic itself, tested against **your own local installation** of the software, running the latest version. You can install a local copy of Statamic by following these [installation instructions](https://statamic.dev/installing). Do not test against any Statamic installation that you don’t own, including [statamic.com](https:/statamic.com) or [statamic.dev](https://statamic.dev).
+We are only interested in vulnerabilities that affect Statamic itself, tested against **your own local installation** of the software, running the latest version. You can install a local copy of Statamic by following these [installation instructions](https://statamic.dev/installing). Do not test against any Statamic installation that you don’t own, including [statamic.com](https:/statamic.com), [statamic.dev](https://statamic.dev), and [demo.statamic.com](https://demo.statamic.com).
 
 ### Potentially Qualifying Vulnerabilities