[COMMONSSITE-187] docs: document security model

As discussed earlier in private in the thread at
https://lists.apache.org/thread/w130p74rx0y60ytlz81h7fx9h7td6vnj
and proposed publicly in
https://issues.apache.org/jira/browse/COMMONSSITE-187

Author: raboof

src/site/xdoc/security.xml

@@ -31,6 +31,28 @@
         of the Commons project</a>.</p>
       </section>
 
+      <section name="Security Model">
+        <p>Commons Compress may be used to process untrusted input data.
+        Input may be read from the network when this is explicitly requested,
+        but the processing of the compressed payload should not trigger
+        additional network access, unbounded deserialization
+        or code execution. It may require processing power proportional to
+        the size of the input. An input causing an OutOfMemoryError,
+        StackOverflowError, or another Error may be considered a DoS
+        vulnerability when it is unexpected based on the size of the input
+        and the resources (RAM, disk, etc) allocated to the process.</p>
+
+        <p>Input causing any other RuntimeException is expected and not a
+        vulnerability, but may be a regular bug when a more appropriate
+        Exception is available</p>
+
+        <p>Regular API parameters are typically designed to work with input
+        that is either trusted or validated/sanitized by the application
+        using the library unless otherwise specified, in accordance with
+        the general <a href="https://commons.apache.org/security.html#Security_Model">
+        Apache Commons Security Model</a>.</p>
+      </section>
+
       <section name="Apache Commons Compress Security Vulnerabilities">
         <p>This page lists all security vulnerabilities fixed in
         released versions of Apache Commons Compress. Each