docs: add security assessment to SECURITY.md

[paradoxbound]

Summary

Adds a Security Assessment section to SECURITY.md documenting the six most likely and impactful threats for this project, along with existing mitigations for each:

1. API credential exposure (HIGH)
2. Unintended write operations (HIGH)
3. Prompt injection via BookStack content (MEDIUM)
4. Insecure transport (MEDIUM)
5. Supply chain compromise (MEDIUM)
6. SSRF via BOOKSTACK_BASE_URL (LOW)

Satisfies OSPS-SA-03.01 — the project must perform a security assessment to understand the most likely and impactful potential security problems.

Test plan

• SECURITY.md renders correctly on GitHub

🤖 Generated with Claude Code