docs: define repository security policy

[zcrab-oai]

Summary

• Add a repository-wide security policy for the workspace manager and production plugins.
• Document untrusted repository data, collaboration tunnels, Slack integrations, AI-agent boundaries, and sensitive tax documents.
• Define reportable security impact, required filesystem and credential protections, and private vulnerability reporting.

Validation

• git diff --cached --check
• Resolved SECURITY.md for plugins/draw/src/server/http.ts with the Codex 安全 policy resolver.
• Confirmed GitHub private vulnerability reporting is enabled.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-27T22:08:21.011030Z	53b399f	PR opened
🔒 安全 Review	✅ Completed 2026-08-27T22:08:37.156810Z	53b399f	PR opened

ℹ️ 关于 Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.