Add SECURITY.md pointing at security-model + reporting flow

[potiuk]

Summary

Makes the canonical discovery chain for the security model explicit
and conventional:

AGENTS.md  ->  SECURITY.md  ->  https://hbase.apache.org/security-model/

Two files changed:

• New SECURITY.md at the repo root — short pointer to the
  published model at https://hbase.apache.org/security-model/
  and to the security@apache.org reporting flow. Intentionally
  doesn't restate the model; the published page stays the source
  of truth.

• AGENTS.md — Security Model section updated — previously
  linked the published page directly; now routes through
  SECURITY.md so the discovery chain is canonical. Same target
  URL on the other end.

Why

Two practical drivers:

1. GitHub UI affordance. GitHub's "Report a vulnerability"
   link surfaces the contents of SECURITY.md at the repo root.
   Without one, well-meaning reporters file public issues or PRs
   against what they perceive as security gaps. Having a one-page
   pointer to the threat model + security@apache.org reduces
   that risk.

2. Agent-driven security tooling discovery. The ASF Security
   team's tooling looks for threat-model references through the
   AGENTS.md → SECURITY.md → published model chain.
   Apache HBase already had the first and third pieces (the
   AGENTS.md Security Model section + the
   /security-model/ page); this commit adds the middle pointer
   so the chain is mechanically followable for anything that
   expects the conventional shape.

This is requested as part of the HBase opt-in to the ASF
Security team's coordinated scan onboarding (the May 2026
[GLASSWING] thread on private@hbase.apache.org); the
request to open this specifically came from Andrew Purtell on
that thread.

What this PR does NOT do

• It does not change the threat model itself. The canonical
  model stays at https://hbase.apache.org/security-model/
  (sourced from hbase-website/app/pages/_landing/security-model/).
• It does not introduce a new reporting alias. Reports
  continue to flow through security@apache.org as the published
  page already documents.
• It does not touch the multi-paragraph navigation /
  conventions content in AGENTS.md — only the Security Model
  section's wording.

Test plan

• Render SECURITY.md on GitHub — confirm the model link
  and security@apache.org mailto resolve.
• Confirm GitHub's "Report a vulnerability" UI affordance
  now surfaces the contents of SECURITY.md.
• Verify AGENTS.md Security Model section reads as a
  canonical chain (AGENTS.md → SECURITY.md → /security-model/).
• git log --oneline -2 on the branch shows the two
  logically-separate commits (one per file) so reviewers
  can read them independently.