docs(security): document STDIO transport security model

[adityamparikh]

Summary

• Adds docs/security/stdio.md documenting the security posture of the Solr MCP server when run in STDIO mode (the default).
• Captures why STDIO has no in-process auth layer — and that this is intentional and spec-aligned — with citations to the MCP specification (Authorization, Transports, Security Best Practices), Spring AI MCP Security reference, spring-ai-community/mcp-security, and Spring Security/Boot Javadoc.
• Pure docs change. No code, config, or behavior changes.

The TL;DR for reviewers: the MCP Authorization spec explicitly says STDIO implementations SHOULD NOT follow OAuth and should retrieve credentials from the environment instead. The doc records that fact and the operational guardrails (don't run elevated, treat SOLR_URL as deployer config, never write to stdout) for future contributors.

A follow-up doc for HTTP-mode security is referenced as planned but not included here.

Test plan

• docs/security/stdio.md renders correctly on GitHub (table, blockquotes, links).
• All external links resolve (MCP spec pages, Spring AI / Spring blog, Spring Security/Boot Javadoc).
• No code paths touched; existing CI (unit + integration) is unaffected.

🤖 Generated with Claude Code