chore: Add SECURITY.md for outlining security policy

[Yicong-Huang]

What changes were proposed in this PR?

Adding SECURITY.md. This document outlines Apache Texera's security model, deployment considerations, and procedures for reporting security vulnerabilities.

Any related issues, documentation, discussions?

Private discussions.
closes #3807.

How was this PR tested?

N/A

Was this PR authored or co-authored using generative AI tooling?

No

[Yicong-Huang]

@chenlica @bobbai00 could you add the link to "how to deploy texera" part?

[chenlica]

@Yicong-Huang Please check this wiki page (https://github.com/apache/texera/wiki/How-to-run-Texera-on-local-Kubernetes) and see if it can serve the purpose for this security document. It's for installing Texera on a local Kubernetes, not a cluster.

[Yicong-Huang]

@Yicong-Huang Please check this wiki page (https://github.com/apache/texera/wiki/How-to-run-Texera-on-local-Kubernetes) and see if it can serve the purpose for this security document. It's for installing Texera on a local Kubernetes, not a cluster.

Seems not enough. Per PJ's previous comment, it might be better to include recommendation on certain file permissions.

One thing that might be useful to add is something about how to deploy
Texera. You might want to recommend that the OS user used to deploy
the application has certain file permissions etc. (to restrict access
to files on the server, ones that we don't want malicious users to try
to access).

[chenlica]

@aicam Can you check these instructions and improve the wiki page?

[aicam]

@aicam Can you check these instructions and improve the wiki page?

I just updated the instructions to include a recommendation on preventing using root user (admin user) for containers.

[Yicong-Huang]

Thanks @aicam. I will mention this wiki in the security policy, as a reference.
Could you change the language inside the wiki so that it says what to do (use non-root containers), but less on why (about what attacker can do, etc.)

[Yicong-Huang]

@pjfanning Thanks for the comments. I have addressed them all, and added information and link to our deployment guide. Please kindly check again.