docs: clarify security standards scope

[mcollina]

Summary

• add a repository security policy aligned with the Fastify organization-wide policy
• document the threat model, reporting and triage process, disclosure timeline, and Security Team
• clarify that fast-uri follows RFC 3986 rather than the WHATWG URL Standard
• classify differences caused by comparing or mixing parsers that follow different standards as outside the security scope
• advise applications to use consistent parsing and normalization rules for security decisions and URI use

Validation

• git show --check
• tests not run (documentation-only change)