docs: rename docs/security.md so GitHub shows the security policy

[cplieger]

Summary

• Renames docs/security.md, to docs/hardening.md for an app and docs/security-model.md for a library, and repoints every link to it.
• GitHub reads any security.md in docs/ as the repository's own security policy. The Security tab therefore showed this page instead of the reporting instructions in the cplieger default SECURITY.md. After the rename, the default shows again.
• No content changed.

Testing

• Every relative Markdown link in the README and docs/ resolves.
• The docs scanner reports no findings.