docs: Add SECURITY.md

[mc-nv]

What does the PR do?

• Adds SECURITY.md: NVIDIA PSIRT reporting channels, architecture context, threat model and security assumptions for this repo.

Checklist

• PR title reflects the change and is of format <commit_type>: <Title>
• Changes are described in the pull request.
• Related issues are referenced.
• Populated github labels field
• Added test plan and verified test passes.
• Verified that the PR passes existing CI.
• Verified copyright is correct on all changed files.
• Added succinct git squash message before merging ref.
• All template sections are filled out.
• Optional: Additional screenshots for behavior/output changes with before/after.

Commit Type:

Check the conventional commit type
box here and add the label to the github PR.

• build
• ci
• docs
• feat
• fix
• perf
• refactor
• revert
• style
• test

Related PRs:

• Same change in other repos; tracked on TRI-1935.

Where should the reviewer start?

• SECURITY.md: threat model and assumptions sections.

Test plan:

• Docs only; pre-commit hooks (license header, codespell) passed.

• CI Pipeline ID:

Caveats:

• Threat model is drawn from the code; treat as a draft for review.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Resolves: TRI-1935