docs: clarify CodeQL scan and merge policy

[haofeif]

Summary

Documentation-only follow-up to #858; refs #857.

• Explain the PR test-merge revision and distinguish scan completion from merge permission.
• Document the PR-diff alert thresholds, required language checks, and default-branch baseline.
• Make explicit that the current policy does not require zero open alerts across the repository before every PR can merge.
• Add examples for new qualifying findings, unchanged baseline alerts, and failed uploads, with GitHub's documented limitations.

Scope

Only SECURITY.md changes. No workflows, queries, permissions, branch rules, application code, or alert states are changed. The remaining controlled acceptance work in #857 is not completed by this documentation PR.

Validation

• uv run --no-sync python scripts/validate_markdown_links.py
• git diff --check -- SECURITY.md

[Copilot]

Copilot review overview

🟢 Approval recommended

The documentation accurately reflects the configured workflow and stated merge policy without changing behavior.

Review effort: Balanced
Findings: None

What changed in this PR

Clarifies how CodeQL scan completion differs from merge eligibility and how baseline alerts affect PRs.

Changes:

• Documents PR merge-revision scanning and required checks.
• Explains alert thresholds, baseline handling, and merge-rule limitations.
• Adds representative success and failure scenarios.

File	Description
SECURITY.md	Clarifies CodeQL scan scope and merge policy.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.