fix: Security: add checklist section for authorized caller role management in vault

[Kaycee276]

Summary

Added a new "Authorized Caller Role Management" checklist section to SECURITY.md, placed directly after the existing "Admin Transfer" section so role-management controls are grouped together.

The new section documents the vault's authorized_caller role (stored in VaultMeta, set via set_authorized_caller) and provides an audit-friendly checklist covering:

• Storage location and uniqueness of the role
• Owner-only rotation enforced by meta.owner.require_auth()
• Emission of the set_auth_caller event for off-chain monitoring
• Rejection of unauthorized callers in deduct / batch_deduct
• Safe handling of the None state (no privilege fallback)
• Test-coverage and operational-runbook expectations
• Explicit scoping of the role to deduct-class operations only

A "Security note" blockquote (matching the style of the existing Revenue Routing section) summarizes the threat model: the role can spend balance within max_deduct so rotation must be prompt if the off-chain driver key is compromised; rotation is atomic, owner-only, and observable via the emitted event.

Changes are documentation-only, minimal, and reviewer-friendly.

---

closes #272