Okay, folks... I finally have this working. I was actually able to demonstrate the working report today and I'm a very happy camper. It's been a rather long hard road to get there. Here's what it took for me:
1.) Visual Studio 2017 CE (community edition) v15.9.14
2.) SSDT installed into that instance of VS 2017 CE.
3.) VSIX package for the MS RDLC designer installed into VS 2017 CE.
4.) Add the v150.1538.0 of the NuGet package for the ReportViewer control to the VS 2017 CE installation using the NuGet Package Manager
5.) Ensure that the Report Server url points to the http://servername/ReportServer link, and not to the link to the reports home page. This is what got me the security error in the first place.
5.) In the Form Load event, you actually have to add the report viewer control to the form to have it appear, as the design surface only shows the control appearing in the strip below where things like data adapters go.
6.) Use a string array of type ReportParameter to hold the parameter values.
7.) Do NOT use ReportViewer1.ReportServer.Refresh(). Instead, use ReportViewer1.RefreshReport().
This was only accomplished today, after having a quick phone call with Brad Supyta of Microsoft, who was able to get me the right method (number 7 above). Without that, I'd still be dead in the water, as the online resources for this are kind of scattered and inconsistent, and much of it is in the "ancient history" category. Heavy duty kudos to Brad and his quick (30 seconds) assistance.
I've posted these all in the hope that someone else doesn't have to struggle quite so much. This was something I had done previously back in the .Net 4.1 days and several SQL Server versions ago, so I had really thought it would be similarly easy. Unfortunately, what's out there in the online documentation is nowhere near as good as it once was (don't remind me of the song about that - I already am singin' it...).