Add security-model discoverability (AGENTS.md -> SECURITY.md -> security model)

Wires the conventional AGENTS.md -> SECURITY.md -> security model chain so automated tooling
can mechanically discover the project's security model. No model content is changed.

patch by Jarek Potiuk; reviewed by Stefan Miklosovic, Michael Semb Wever for CASSANDRA-21464

Assisted-by: Claude Opus 4.8 (1M context)

.build/build-rat.xml

@@ -89,6 +89,7 @@
                  <!-- legal files -->
                  <exclude NAME="NOTICE.txt"/>
                  <exclude NAME="LICENSE.txt"/>
+                 <exclude NAME="SECURITY.md"/>
                  <!-- AI agent instruction files -->
                  <exclude NAME="AGENTS.md"/>
                  <exclude NAME="CLAUDE.md"/>

AGENTS.md

@@ -67,3 +67,15 @@ General style conventions:
 - 🚫 Never run the full test suite — it takes hours. Run targeted tests only.
 - 🚫 Never bypass Checkstyle violations without a suppression comment explaining why.
 - ⚠️ Ask before modifying the CQL grammar (`src/antlr/Cql.g`) — changes cascade widely.
+
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md), which links to the project's
+security model at
+[doc/modules/cassandra/pages/reference/security-model.adoc](./doc/modules/cassandra/pages/reference/security-model.adoc).
+
+Automated agents (security scanners, code analyzers) that scan this
+repository should consult that security model for the project's in-scope /
+out-of-scope declarations, trust boundaries, the security properties
+Cassandra provides and disclaims, and how findings are triaged, before
+reporting issues.

SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report suspected security vulnerabilities in Apache Cassandra
+privately to the Apache Security Team at <security@apache.org>, following the
+ASF process at <https://www.apache.org/security/>. Do not open public GitHub
+issues or pull requests for security reports.
+
+## Security Model
+
+Apache Cassandra's security model - what is in and out of scope, the trust
+boundaries it assumes, the security properties the project provides and
+disclaims, and how findings are triaged - is documented in-repo at
+[doc/modules/cassandra/pages/reference/security-model.adoc](./doc/modules/cassandra/pages/reference/security-model.adoc).