Add security research guidance and threat model

[tob-scott-a]

This adds two Markdown files under .github to instruct AI agents how to more effectively work with liboqs. The intention is to improve the signal-to-noise ratio and reduce the rate of invalid LLM-generated security reports.

• Does this PR change the input/output behaviour of a cryptographic algorithm (i.e., does it change known answer test values)? (If so, a version bump will be required from x.y.z to x.(y+1).0.)
  • No.
• Does this PR change the list of algorithms available -- either adding, removing, or renaming? Does this PR otherwise change an API? (If so, PRs in fully supported downstream projects dependent on these, i.e., oqs-provider will also need to be ready for review and merge by the time this is merged. Also, make sure to update the list of algorithms in the continuous benchmarking files: .github/workflows/kem-bench.yml and sig-bench.yml)
  • No.

These documents were generated by Codex-5.5-Cyber as part of the Patch the Planet program.

[coveralls]

Coverage is 82.299% — tob-scott-a:deliverable/docs-security-guidance into open-quantum-safe:main. No base build found for open-quantum-safe:main.