The states say the Securities and Exchange Commission exceeded its rulemaking authority in requiring public companies to disclose climate-related risks as part of their registrations and annual filings.