Add a draft security threat model and discoverability files (AGENTS.md, SECURITY.md)

[potiuk]

This is a proposal for the PMC to review, own, and merge — please correct, reject, or discuss as needed. Nothing here is a requirement, and the threat model is explicitly a v0 draft for you to react to.

This PR adds three files to apache/mynewt-core (the RTOS — this model is an umbrella that cross-references the apache/mynewt-nimble and apache/mynewt-mcumgr models):

• THREAT_MODEL.md — a v0 security threat model, drafted by the ASF Security team from the repository's public artefacts against a standard rubric (Michael Scovetta's). Every claim is provenance-tagged (documented / maintainer / inferred); since no maintainer has reviewed it yet, most claims are inferred, and each is routed to a numbered question in §14 "Open questions for the maintainers". Please treat it as a starting point, not a finished document.
• SECURITY.md — a standard security-reporting policy (report privately to security@apache.org) that links to the threat model.
• AGENTS.md — a small pointer file so automated tooling can mechanically discover the model via the conventional AGENTS.md → SECURITY.md → THREAT_MODEL.md chain.

Context: the ASF Security team is preparing this repository for an automated agentic security scan we're piloting. Such scans look for the model along that discoverability chain and run far less noisily when a model stating what is and isn't a security concern is present. The Security team has reached out separately on the PMC's private list with the program details.

The single most useful thing you can do with this PR is to work through the §14 questions — those are where we inferred a position and would value your confirmation or correction. Wording, scope, and structure are all open; merge, request changes, or take it over as you see fit.

[potiuk]

Update: pushed the ASF license header onto the three added files (AGENTS.md, SECURITY.md, THREAT_MODEL.md) and tidied the commit message to the project's convention — the Licensing and "Check commit messages" checks now pass (rest of CI green/finishing). Ready for review whenever someone on the PMC has a moment.