docs: add security model documentation

[Cedarich]

Description

This PR adds the docs/security.md file to document the security model of the Bridgelet Core system. It covers the threat model, authorization mechanisms, security guarantees, and best practices for integrators.

Changes

• Created docs/security.md.
• Documented key threat vectors:
  • Unauthorized Sweeping.
  • Double Spending / Replay Attacks.
  • Expiration Bypass.
  • Malicious Initialization.
• Detailed the layered authorization model (Creator for Init, Ed25519 for Sweep, Public for Expiry).
• Highlighted critical limitations, specifically the current lack of signature verification in EphemeralAccount::sweep (must use SweepController).

Checklist

• Documentation created.
• Threat model defined.
• Authorization flows explained.
• Limitations disclosed.

close #10

[phertyameen]

Short and concise is all that's needed. cool!