[CNCF Graduation] [Recommendation] Add spec-level security guidance for platform implementers

[kfaseela]

The current security work (third-party audit, SECURITY.md, response process) is implementation-focused. Since CNB involves executing untrusted code during container builds, the spec should document security considerations for platform implementers: trust boundaries between platform, lifecycle, and buildpack execution; filesystem isolation requirements; and network access controls during builds.

Raised as a non-blocking recommendation during CNCF graduation due diligence cncf/toc#1538

[kfaseela]

cc @hone