docs(security): re-baseline the threat model on S2-070..S2-074 (#1852)

The v0 threat model predates the five bulletins published on 2026-08-14,
and read against them it does not describe the framework the PMC has been
defending. Three of the five would have been closed as non-findings, and
the other two had no security property to violate.

The DoS boundary is the substantive error. SECURITY.md says two separate
things: a disclaimer about generic attacks against any networked server,
and a design philosophy about avoiding resource consumption non-linear in
the size of inputs. The model fused them into a triage threshold and put
everything linear out of scope - so S2-072 landed squarely on §11a's "I
streamed a huge body", and the growth in all three DoS bulletins is
linear. All three carry CVEs. Restate the line as boundedness rather than
curve shape, in §3/§9/§11a, and add the matching paragraph to SECURITY.md
so the model stops paraphrasing that document into a rule it does not
state.

Add the two properties the bulletins show the framework actually owes:
§8.6 per-request state isolation (S2-070/071 - shared parse and
serialization state across concurrent requests, which in S2-070 also
defeated a configured limit) and §8.7 bounded consumption of
request-derived input (S2-072/073/074 - bounded body reads, bounded
framework-managed state, and a limit that must bound the read it names).
§7 gains the two client capabilities these imply, concurrency and
repetition; §6 gains the request body as its own surface and a note that
a value used as a cache key is an input class of its own.

Separate "optional feature" from "non-default configuration" in §2 and
§13. Four of the five bulletins concern surfaces that are off until an
application enables them, and as written the model let a triager close
every one as OUT-OF-MODEL: non-default-config. That disposition is for
settings documented as unsafe, not for features documented as available.

Record the 7.3.0/6.11.0 hardening in §5a - struts.i18n.cacheMaxSize,
struts.csp.report.maxSize, and the opt-in
struts.locale.validateRequestLocale - as a second envelope change after
7.0. Q-dos and Q-plugins move to answered, since the PMC settled both by
issuing CVEs; Q-concurrency, Q-bounds and Q-optional take their place.
§12 gains the trigger that would have caught this earlier: a published
bulletin whose class is not already a §8 property. §16 maps each bulletin
to the sections it drives.

Everything here is sourced from the published bulletins. The bulletins
are deliberately terse about mechanism, and this document holds that
line: it describes the classes of defect and what they mean for triage,
not where the framework was weak or how to reach it.

Still a draft, still unratified - the corrections are drawn from the
published bulletins, not from a PMC position on the model itself.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>