doc: clarify the runc's threat model

[lifubang]

We greatly appreciate the ongoing engagement of the security research community with runc.
By clarifying the threat model, we hope to make this collaboration as productive as possible,
and enable researchers to quickly determine whether a finding falls within runc’s scope,
so we can respond more swiftly and effectively.

[Copilot]

Pull request overview

This PR expands SECURITY.md with a detailed threat model for runc to help security researchers quickly determine what classes of issues are in-scope vs out-of-scope for reporting.

Changes:

• Adds a new “Threat Model” section explaining runc’s role, security boundary, and trust assumptions around config.json.
• Enumerates in-scope vs out-of-scope vulnerability classes, with concrete examples and a pre-reporting checklist.
• Adds a small reference table of real-world runc CVEs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lifubang]

The latest force push was related to the PoC.

[cyphar]

I'll review this soon, but I should mention that @rata and I came up with some bullet points earlier this year for stuff we would need so he will certainly have some input as well.

[kolyshkin]

SGTM

@cyphar PTAL

[kolyshkin]

I'll review this soon, but I should mention that @rata and I came up with some bullet points earlier this year for stuff we would need so he will certainly have some input as well.

@cyphar @rata If this one is a good starting point, can we merge this as is and then address your concerns as a followup?