docs(security): inherit Git's threat model explicitly

<!-- agent -->
`SECURITY.md` described supported versions and vulnerability reporting without
defining which repository inputs are trusted. This left the distinction between
untrusted repository content and locally supplied administration data unclear.

Document that both GitPython backends inherit Git's threat model directly.
Summarize the trust placed in local configuration and hooks, the limits of
ownership checks and filesystem confinement, and Git's guidance for obtaining
a clean copy of an untrusted repository. Link to Git's documentation on GitHub
and keep violations of its intended security boundaries reportable, including
bugs that also affect Git.

Checked the summary against the local Git reference at
`6de20f6092dcf9bdb1c8efe03db4b70c82b423dd`. `git diff --check` passes.
No runtime tests were run because this change only updates documentation.

Assisted-by: GPT 6.0 Astra
Co-authored-by: GPT 6.0 Astra <codex@openai.com>

Author: codex

SECURITY.md

@@ -9,6 +9,37 @@ Only the latest version of GitPython can receive security updates. If a vulnerab
 | 3.x.x   | :white_check_mark: |
 | < 3.0   | :x:                |
 
+## Threat Model
+
+GitPython inherits its threat model directly from Git. The trust boundaries in
+[Git's security documentation](https://github.com/git/git/blob/master/Documentation/git.adoc#security)
+apply to both the CLI and Gix backends:
+
+- **Repository content may be untrusted.** Cloning an untrusted repository and
+  inspecting its history are supported operations. A clone creates local
+  repository metadata without copying the source repository's configuration or
+  hooks. Tracked files, including `.gitmodules`, remain untrusted input.
+- **Local repository metadata must be trusted.** Running commands in an
+  attacker-supplied `.git` directory, bare repository, or surrounding worktree is
+  unsafe: configuration and hooks can execute commands. This includes repositories
+  received in archives or copied directories. Owning the extracted files or listing
+  a repository in `safe.directory` does not make its contents trustworthy.
+- **Repository paths are not a sandbox.** Git supports metadata and working trees
+  in [separate locations](https://github.com/git/git/blob/master/Documentation/git-clone.adoc),
+  including metadata reached through gitfiles or symlinks.
+  GitPython does not promise that all filesystem access stays within a checkout
+  or `.git` directory. Paths supplied by untrusted repository content must still
+  receive Git's intended protections.
+
+For an untrusted repository directory, Git recommends obtaining a clean copy with
+`git clone --no-local` before running other commands. Serving the source through
+`git-upload-pack` still has an attack surface; Git recommends using an
+unprivileged user for additional isolation. See
+[Git's `git-upload-pack` security guidance](https://github.com/git/git/blob/master/Documentation/git-upload-pack.adoc#security).
+
+Violations of these trust boundaries or bypasses of Git's intended protections
+remain reportable, including cases where Git itself is affected.
+
 ## Reporting a Vulnerability
 
 Please report private portions of a vulnerability to <https://github.com/gitpython-developers/GitPython/security/advisories/new>. Doing so helps to receive updates and collaborate on the matter, without disclosing it publicly right away.