Add a draft security threat model and discoverability files (AGENTS.md, SECURITY.md)

[potiuk]

This is a proposal for the PMC to review, own, and merge — please correct, reject, or discuss as needed. Nothing here is a requirement, and the threat model is explicitly a v0 draft for you to react to.

This PR adds three files to apache/mynewt-nimble (the BLE host + controller stack):

• THREAT_MODEL.md — a v0 security threat model, drafted by the ASF Security team from the repository's public artefacts against a standard rubric (Michael Scovetta's). Every claim is provenance-tagged (documented / maintainer / inferred); since no maintainer has reviewed it yet, most claims are inferred, and each is routed to a numbered question in §14 "Open questions for the maintainers". Please treat it as a starting point, not a finished document.
• SECURITY.md — a standard security-reporting policy (report privately to security@apache.org) that links to the threat model.
• AGENTS.md — a small pointer file so automated tooling can mechanically discover the model via the conventional AGENTS.md → SECURITY.md → THREAT_MODEL.md chain.

Context: the ASF Security team is preparing this repository for an automated agentic security scan we're piloting. Such scans look for the model along that discoverability chain and run far less noisily when a model stating what is and isn't a security concern is present. The Security team has reached out separately on the PMC's private list with the program details.

The single most useful thing you can do with this PR is to work through the §14 questions — those are where we inferred a position and would value your confirmation or correction. Wording, scope, and structure are all open; merge, request changes, or take it over as you see fit.

[potiuk]

Update: added the ASF license header to the three added files and tidied the commit message — Licensing and "Check commit messages" now pass and the rest of CI is green. Ready for review whenever convenient.