docs: add security policy, threat model, and agent guide

Add SECURITY.md pointing to the ASF security process, and a draft
THREAT_MODEL.md that records what JMeter treats as in and out of
scope, its adversary model, the security properties it provides, and
how findings are triaged. The threat model builds on the existing
security.html policy rather than replacing it.

Add AGENTS.md as a one-line pointer so scanners and AI assistants
discover the security model. Exclude the three headerless docs from
RAT in .ratignore.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 2 people

.ratignore

@@ -3,13 +3,16 @@ gradle/verification-keyring.keys
 gradle/verification-metadata.xml
 **/.*
 .*/**
+AGENTS.md
 CODE_OF_CONDUCT.md
 CONTRIBUTING.md
 eclipse.md
 gradle.md
 ISSUE_TEMPLATE.md
 PULL_REQUEST_TEMPLATE.md
 README.md
+SECURITY.md
+THREAT_MODEL.md
 renovate.json
 **/*.jmx
 bin/examples/**

AGENTS.md

@@ -0,0 +1 @@
+Security model: [SECURITY.md](./SECURITY.md)

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+`apache/jmeter` follows the [Apache Software Foundation security process](https://www.apache.org/security/). Please report suspected
+vulnerabilities privately to `security@apache.org`; do not open public
+GitHub issues or pull requests for security reports.
+
+## Threat Model
+
+What the project treats as in scope and out of scope, the security
+properties it provides and disclaims, the adversary model, and how
+findings are triaged are documented in [THREAT_MODEL.md](./THREAT_MODEL.md).