[codex] make security triage visible

[h4x3rotab]

Summary

• Add root SECURITY.md, README security entry points, and a security triage page for answered, accepted, hardening, and roadmap findings.
• Route exploitable vulnerabilities to GitHub private security reporting or the listed security contact instead of public GitHub issues.
• Clarify production security boundaries for dev KMS settings, KMS mTLS route enforcement, key derivation behavior, and timestamped KMS env-encryption key verification.
• Align the security model with the README by documenting AMD SEV-SNP as new and experimental while keeping Intel TDX as the production path.

Why

Open public security issues made the repo look riskier than the maintainer position. The PR makes the security posture visible from the README, root security policy, docs index, tutorials, and SDK references without creating a public vulnerability-reporting issue template.

Validation

• git diff --check
• prek run --files README.md SECURITY.md docs/security/README.md sdk/go/README.md
• Searched for stale responsible-disclosure wording, public-vulnerability-reporting wording, and unsafe fallback wording

Follow-up

• Keep Security: App keys and decrypted env vars written with world-readable permissions #606 open until 0600 secret-file hardening lands.
• After this PR lands, close or update the March cluster issues with links to the triage page.