SECURITY: Remove compromised d3-color package (Supply Chain Attack)

Critical security fix for supply chain attack on d3-color package. Removed compromised dependency and switched to full D3 bundle. Added SECURITY.md documenting the incident. Closes #1 (closed)

@michael_usanchenko please review this supply chain incident