[CALCITE-7674] Add Avatica threat model

Author: rubenada

.ratignore

@@ -2,6 +2,8 @@
 **/.gitignore
 .ratignore
 .idea/vcs.xml
+AGENTS.md
+SECURITY.md
 # Third-party license files
 src/main/config/licenses/
 #

AGENTS.md

@@ -0,0 +1,18 @@
+# Agent guidance
+
+This file is read by automated agents (security scanners, code analyzers,
+AI assistants) operating on this repository. It points them at the
+human-authored references they should consult before producing output.
+
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md), which links to the project's
+threat model at
+[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md).
+
+Avatica is a JDBC/ODBC wire-protocol layer: a server that fronts a
+local JDBC `DataSource` (typically Apache Calcite, but any JDBC driver
+is supported), and a client-side JDBC driver that speaks the Avatica
+wire protocol over HTTP or HTTPS. Read the threat model before
+reporting anything, it is explicit about what it does and does not treat
+as a vulnerability.

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+`apache/calcite-avatica` follows the [Apache Software Foundation security process](https://www.apache.org/security/).
+Please report suspected vulnerabilities privately to `security@apache.org`; do not open public
+GitHub issues or pull requests for security reports.
+
+## Threat Model
+
+What the project treats as in scope and out of scope, the security
+properties it provides and disclaims, the adversary model, and how
+findings are triaged are documented in [THREAT_MODEL.md](site/_docs/security_threat_model.md).