docs: strengthen Python SDK security contribution guidance (#3639)

- [x] I understand that this repository is auto-generated and my pull
request may not be merged

## Changes being requested

- Add focused Python SDK security requirements for coding agents and
contributors: safe fake fixtures, credential and log redaction,
direct/transitive dependency and lockfile review, reviewed GitHub Action
pins, least-privilege CI, and protected PyPI Trusted Publishing.
- Require SDK CODEOWNER review and relevant synchronous/asynchronous
regression tests for authentication, X.509, webhook, network, file,
serialization, dependency, and release-sensitive changes.
- Explicitly direct vulnerability reports to the existing private
coordinated-disclosure process instead of public issues, discussions, or
pull requests.

## Verification

- `git diff --check`
- CommonMark parsing, local-link validation, security-policy coverage
assertions, and credential-like-literal checks for all three changed
Markdown files.
- `python scripts/check-python-version-policy.py` — passed.
- `python -m pytest -o addopts= -p no:cacheprovider -k 'not aiohttp'
tests/test_utils/test_logging.py tests/test_auth.py
tests/api_resources/test_webhooks.py` — 72 passed; 13 optional `aiohttp`
cases were deselected because that extra is absent from the existing
environment.

## Additional context & links

Documentation only: no generated SDK source, GitHub workflows,
repository settings, credentials, or release controls were changed.