docs: add prompt injection threat model

[AKilalours]

Summary

This PR adds a prompt injection threat model for AI-assisted security review workflows.

Why

The README already notes that this action is not hardened against prompt injection attacks and recommends workflow approval for untrusted PRs. This documentation expands that guidance with concrete attack scenarios, risk areas, and maintainer mitigations.

Changes

• Added docs/prompt_injection_threat_model.md
• Documented prompt injection risks in Markdown, code comments, configuration files, and false-positive filtering
• Added defensive review guidance for treating repository content as untrusted input
• Added a maintainer checklist for safer security-review workflow usage
• Linked the new threat model from the README security considerations section

Testing

• Documentation-only change
• Checked Markdown formatting locally

[AKilalours]

Hi maintainers,

I opened this as a small documentation contribution to expand the existing prompt injection warning into a concrete threat model for AI-assisted security review workflows.

Happy to revise the wording, file location, or scope if you prefer a different structure.