docs: add Iceberg security model

[sungwy]

Similar to: apache/iceberg#16538

This PR publishes a security model for Iceberg and adds a detailed threat model referenced from AGENTS.md so there is a clear project reference for how Iceberg distinguishes security issues from other bugs.

The goal is to make Iceberg’s security boundaries explicit for both human triage and automated scanning, and to reduce false positives in future security reporting.

This PR was drafted with AI assistance and then manually reviewed and edited to reflect the project’s current approach to security roles, trust boundaries, and the handling of recent security reports.

Note:

AGENTS.md is currently in .gitignore, but this file was force committed to ensure that agents running automated security scans will be able to find the security model.

[Copilot]

Pull request overview

This PR adds repository-level guidance for security triage in Apache Iceberg C++, defining the project’s security boundaries for maintainers and automated scanners.

Changes:

• Adds a detailed Iceberg C++ security threat model.
• Adds AGENTS.md to direct automated agents to the threat model.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
SECURITY-THREAT-MODEL.md	Defines security goals, roles, trust boundaries, in-scope vulnerabilities, out-of-scope categories, and scanner calibration rules.
AGENTS.md	Points automated agents to the new security threat model as the authoritative reference.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.