Remove the hardcoded security@apache.org address from the security-cve-allocate skill

[justinmclean]

Summary

skills/security-cve-allocate/SKILL.md contains a literal security@apache.org address.
Framework skills are meant to be project-agnostic, and this is the only hardcoded ASF security
address anywhere under skills/. Remove it without losing the guidance it carries.

Background

Magpie separates two layers: the framework (project-agnostic skills and tools) and
adopter-specific configuration and adapters. AGENTS.md § Repository purpose says the
framework contains "no project-specific content", and PRINCIPLE 12 states it as "The framework
is project-agnostic; concrete names live in adopter config".

A fallback note about emailing the ASF security team was added to two files at once. In
tools/cve-tool-vulnogram/allocation.md it is correctly placed — that is the ASF-specific
adapter. In skills/security-cve-allocate/SKILL.md it is not: a non-ASF adopter running that
skill is told to email the Apache Software Foundation about their own CVE.

Two ways to fix it, either acceptable:

• Drop the note from the skill and have the skill point at the adapter section that already
  carries it. This also fixes a second problem — the two copies have already drifted, one saying
  "no governance-authorised member" and the other "no PMC member".
• Keep a note in the skill but use the <asf-security-list> placeholder, which the framework
  already uses for exactly this concept (see AGENTS.md lines 643 and 702).

Note that the automated placeholder check will not catch this: tools/dev/check-placeholders.sh
matches a fixed list of forbidden strings and that address is not on it. A green prek run is
not evidence the boundary held.

Where to look

• skills/security-cve-allocate/SKILL.md — search for security@apache.org (one occurrence,
  in the fallback note near the "Wait for the user to report back a CVE token" instruction).
• tools/cve-tool-vulnogram/allocation.md — the correctly-placed copy of the same note.
• AGENTS.md § Placeholder convention used in skill files, and lines 643 / 702 for
  <asf-security-list> in use.

Acceptance criteria

• grep -rn "security@apache.org" skills/ returns nothing.
• The guidance is still reachable from the skill (either inline via a placeholder, or by a
  link to the adapter section).
• tools/cve-tool-vulnogram/allocation.md is unchanged or only gains the linked-to anchor.
• prek run --all-files passes.

Estimated effort

~45 minutes for someone new to the codebase.

Getting started

[How to contribute](https://github.com/apache/airflow-steward/blob/main/CONTRIBUTING.md#your-first-contribution)

This issue was drafted with the help of an AI-assisted tool and reviewed by a Magpie maintainer before posting. If anything here is unclear or looks wrong, say so on the issue: a real person is reading.