Document security model

On the subject of security, the Avro website says:

Apache Avro project shares the same security policy as the Apache Software Foundation

Although simple & clear, this says nothing about the security model of Avro.

To improve, we should document our security model.