docs(security): document runtime update check

[DeusData]

Summary

• document the MCP server runtime network behavior in SECURITY.md
• clarify that indexing, queries, and MCP tool handling remain local
• identify the GitHub releases metadata check as the only best-effort runtime external request
• note offline failure behavior and the bounded curl timeout

Verification

• git diff --check -- SECURITY.md
• smoke probe with a fake failing curl: initialize response returned in 0.009s while curl slept/fails