Add SECURITY.md and AGENTS.md for security-model discoverability

[potiuk]

Summary

Adds SECURITY.md and AGENTS.md to apache/trafficserver-ingress-controller so the project's security model is mechanically discoverable from the repo root.

SECURITY.md references apache/trafficserver/SECURITY.md as the umbrella model for the C++ core, then adds two repo-specific paragraphs covering the trust surfaces that aren't covered by the umbrella:

• Kubernetes admission webhook — validates Ingress / Service / Endpoints / ConfigMap payloads received from the API server; webhook bodies treated as adversary-controlled input.
• Ingress routing — Ingress resources → ATS remap.config translation; RBAC on Ingress create/update is the trust boundary on the outbound routing table.

AGENTS.md points coding agents at SECURITY.md for security-model reads (same shape as apache/trafficserver/AGENTS.md's security bridge).

Coordinated with the Traffic Server PMC.

Test plan

• N/A — documentation only.