[CALCITE-7674] Add Avatica threat model

.ratignore

@@ -2,6 +2,8 @@
 **/.gitignore
 .ratignore
 .idea/vcs.xml
+AGENTS.md
+SECURITY.md
 # Third-party license files
 src/main/config/licenses/
 #

AGENTS.md

@@ -0,0 +1,10 @@
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md), which links to the project's
+threat model at
+[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md).
+
+Avatica is a JDBC/ODBC wire-protocol layer: a server that fronts a
+local JDBC `DataSource` (typically Apache Calcite, but any JDBC driver
+is supported), and a client-side JDBC driver that speaks the Avatica
+wire protocol over HTTP or HTTPS.

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+`apache/calcite-avatica` follows the [Apache Software Foundation security process](https://www.apache.org/security/).
+Please report suspected vulnerabilities privately to `security@apache.org`; do not open public
+GitHub issues or pull requests for security reports.
+
+## Threat Model
+
+What the project treats as in scope and out of scope, the security
+properties it provides and disclaims, the adversary model, and how
+findings are triaged are documented in the
+[threat model](site/_docs/security_threat_model.md).

site/_data/docs.yml

@@ -38,6 +38,10 @@
   - go_client_reference
   - go_howto
 
+- title: Security
+  docs:
+    - security_threat_model
+
 - title: Avatica Meta
   docs:
   - history