doc: add CPython Threat Model and update security policy (#1803)

[nayanraj864-cmyk]

This PR creates an explicit CPython Threat Model document and updates the Security Policy to set clear guidelines for vulnerability reports submitted to the Python Security Response Team (PSRT).

Changes Included:

• security/threat-model.rst: Created a new threat model detailing CPython's security boundaries, trusted execution assumptions (command-line flags, environment variables, memory/C-API), non-sandboxing policy (eval, exec, pickle), availability constraints, and standard library module threat models (ssl, urllib, xml, subprocess, tarfile).
• security/policy.rst: Linked the threat model, added explicit LLM model disclosure requirements for reporters, and emphasized Code of Conduct prioritization.
• security/index.rst: Registered threat-model in the section Table of Contents.

Closes #1803

[nayanraj864-cmyk]

@sethmlarson
Hello,

My name is Nayan Raj, and I have recently started contributing to organizations that participate in Google Summer of Code (GSoC). This is my first experience contributing to a GSoC organization, although I have previously worked on other open-source projects and have some contribution experience.

I would greatly appreciate any guidance, suggestions, or feedback that could help me improve my contributions and better understand the GSoC contribution process. I am eager to learn, enhance my skills, and become a valuable contributor to the community.

Thank you for your time and support. I look forward to learning from your experience and contributing effectively to the project.

Best regards,
Nayan Raj

[read-the-docs-community]

Documentation build overview

📚 CPython devguide | 🛠️ Build #34456508 | 📁 Comparing f004588 against latest (9d481ef)

  🔍 Preview build  

2 files changed

+ security/threat-model/index.html
± security/policy/index.html

[StanFromIreland]

have recently started contributing to organizations that participate in Google Summer of Code (GSoC).

I'm sorry, but we're not part of GSoC this year.

Also some notes on the documents, it largely duplicates existing information (that's in the docs and/or the security policy), so in it's current state I'm afraid it's not particularly helpful. Also, did you use an LLM to generate the page?

[StanFromIreland]

This is a separate change, not related to the threat model. I also don't see any particular need for it.