[docs] Add security reporting documentation

[matrixsparse]

What is the purpose of the change

This PR adds a security page describing how to report security issues to the Apache Security Team, satisfying the maturity assessment QU30 requirement.

Brief change log

• Add website/community/security.md with security reporting guidelines
• Reference Paimon and OpenDAL's security page structure and wording

Verifying this change

• Preview the documentation locally using npm start in the website directory
• Verify the Security page appears in the Community sidebar

Does this pull request introduce a breaking change?

• No

Documentation

• New documentation added: security.md

Closes #3074

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new documentation page outlining how to privately report security vulnerabilities to the Apache Security Team to satisfy maturity assessment QU30.

Changes:

• Added website/community/security.md security reporting guidelines page
• Included instructions to email the Apache Security Team and what details to provide
• Added a sidebar entry via frontmatter (sidebar_position: 8)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Several phrases are ungrammatical/awkward and may reduce clarity for a security-reporting process (e.g., missing articles, wrong prepositions, and mixed wording). Consider rewriting for clear, precise instructions (e.g., 'discover a vulnerability or potential threat', 'send an email', 'include reproduction steps', 'before disclosing publicly').

Suggested change

	If you have apprehensions regarding Fluss's security or you discover vulnerability or potential threat, don't hesitate to get in touch with the Apache Security Team by dropping a mail at **security@apache.org**.
	In the mail, specify the project name **Fluss** with the description of the issue or potential threat. You are also urged to recommend the way to reproduce and replicate the issue. The security team and the Fluss community will get back to you after assessing and analysing the findings.
	**PLEASE PAY ATTENTION** to report the security issue on the security email before disclosing it on public domain.
	If you have concerns regarding Fluss's security or discover a vulnerability or potential threat, please contact the Apache Security Team by sending an email to **security@apache.org**.
	In the email, specify the project name **Fluss** and include a description of the issue or potential threat. You are also encouraged to include steps to reproduce the issue. The security team and the Fluss community will get back to you after assessing and analyzing the findings.
	**PLEASE PAY ATTENTION** to report the security issue to the security email address before disclosing it publicly.

[Copilot]

The instruction is unclear and uses non-idiomatic wording ('on the security email', 'on public domain'). For documentation that may be referenced during incidents, use explicit, unambiguous language (e.g., 'Please report security issues privately to security@apache.org before disclosing publicly'). This reduces the chance of accidental public disclosure.

Suggested change

	**PLEASE PAY ATTENTION** to report the security issue on the security email before disclosing it on public domain.
	**PLEASE PAY ATTENTION** to report the security issue privately to **security@apache.org** before disclosing it publicly.

[luoyuxia]

@matrixsparse Hi, lgtm to overall. But seems copilot suggestion make it clear. Maybe you can take these suggestions.

[matrixsparse]

Hi @luoyuxia, Updated the wording as suggested. PTAL

[luoyuxia]

+1