[doc](security) Add SECURITY.md threat model entry point

[CalvinKirs]

What problem does this PR solve?

Issue Number: None

Related PR: None

Problem Summary: Security tooling and reviewers expect a root SECURITY.md entry point. The threat model already defined SECURITY.md coexistence under M16, but the repository did not provide the conventional file.

Release note

None

Check List (For Author)

• Test: Manual test
  • Ran git diff --cached --check and verified the SECURITY.md -> threat-model.md discovery chain.
• Behavior changed: No
• Does this need documentation: No, documentation-only change.

What problem does this PR solve?

Issue Number: close #xxx

Related PR: #xxx

Problem Summary:

Release note

None

Check List (For Author)

• Test

  • Regression test
  • Unit Test
  • Manual test (add detailed scripts or steps below)
  • No need to test or manual test. Explain why:
    • This is a refactor/code format and no logic has been changed.
    • Previous test can cover this change.
    • No code files have been changed.
    • Other reason

• Behavior changed:

  • No.
  • Yes.

• Does this need documentation?

  • No.
  • Yes.

Check List (For Reviewer who merge this PR)

• Confirm the release note
• Confirm test cases
• Confirm document
• Add branch pick label

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[morningman]

skip buildall

[CalvinKirs]

/review

[github-actions]

Reviewed PR 63553.

No blocking issues found.

Critical checkpoint conclusions:

• Goal/test: Adds a root SECURITY.md entry point and updates threat-model references consistently; documentation-only manual verification is sufficient.
• Scope/focus: Change is small, focused, and clear.
• Concurrency/lifecycle/config/compatibility/transactions/data writes/protocol: Not applicable to this documentation-only change.
• Parallel paths: AGENTS.md, SECURITY.md, and threat-model.md consistently route security triage through SECURITY.md to threat-model.md.
• Tests/results: No executable tests required; no generated test results changed.
• Observability/performance: Not applicable.
• User focus: No additional user-provided review focus.

[github-actions]

PR approved by at least one committer and no changes requested.

[github-actions]

PR approved by anyone and no changes requested.