Add security-model discoverability pointer to the project-wide CloudStack threat model

[potiuk]

Summary

Apache CloudStack's security model is project-wide, not per-repository. This PR replaces the earlier standalone draft-THREAT-MODEL.md in this repo with the standard discoverability chain so automated scanners find the one canonical model:

• AGENTS.md → SECURITY.md → the project-wide model at
  https://github.com/apache/cloudstack/blob/main/THREAT_MODEL.md

The model lives in apache/cloudstack (see apache/cloudstack#13293); this repo inherits it via the pointer above rather than duplicating it — per the PMC's direction on #13293 to converge on the parent model first. The link resolves once that model lands on main. A thin repo-specific addendum can be added here later if this component needs one.

AGENTS.md carries a one-line SPDX header (it is read by agents on every session); SECURITY.md carries the full ASF header.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.05%. Comparing base (4740dbc) to head (59a93f2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #97   +/-   ##
=======================================
  Coverage   50.05%   50.05%           
=======================================
  Files           4        4           
  Lines         975      975           
=======================================
  Hits          488      488           
  Misses        473      473           
  Partials       14       14           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[yadvr]

There's a lot of details in the draft that needs a better set of eyes, so assigning @DaanHoogland @vishesh92 who're also PMC leads on the work.

[potiuk]

Thanks @yadvr — routing to @DaanHoogland and @vishesh92 makes sense. These are just discoverability pointers to the project-wide model in #13293, so they'll naturally follow once that lands. Standing by for the leads' review — happy to reshape the pointers to match whatever #13293 settles on. No rush from our side.

[Copilot]

Pull request overview

Adds repository-level security discoverability documentation so automated tooling and contributors can find the Apache CloudStack project-wide security model from this repo.

Changes:

• Introduces SECURITY.md with ASF security reporting guidance and a pointer to the project-wide threat model.
• Introduces AGENTS.md to direct automated agents/scanners to SECURITY.md for the security model chain.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
SECURITY.md	Adds a security policy plus a pointer to the CloudStack-wide threat model.
AGENTS.md	Adds an agent/scanner entry point that links to SECURITY.md.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vishesh92]

lgtm

[vishesh92]

Merging for now. We can revisit later if any changes are required here.