docs: expand security threat model

[zeroshade]

Summary

• adapt the expanded Iceberg Python threat-model structure to Iceberg Go's actual catalog, REST, configuration, IO, and CLI boundaries
• preserve Iceberg Go-owned credential isolation across separately constructed catalog/client instances while distinguishing caller-shared state
• clarify private vulnerability reporting, delegated credentials, endpoint routing, resource limits, table provenance, and destructive external-path behavior
• make scanner calibration conditional and require human review instead of blanket rejection

Review notes

The Go model intentionally does not copy Python's blanket same-process isolation disclaimer or assume universal table-root containment. Availability-only findings remain hardening by default unless they violate a documented Iceberg Go-owned boundary or demonstrate another security impact.

Verification

• go test ./... — 28 packages passed; 6 packages had no tests
• git diff --check origin/main..HEAD
• final task review and whole-branch security-policy review completed with no remaining Critical or Important findings

[zeroshade]

Superseded by apache#1886.