Ensure GitProxy adheres to OSPS Baseline Level 3

[jescalada]

I scanned GitProxy using AI based on the most recent OSPS Baseline criteria. Fortunately, the project adheres completely to Level 1, and mostly hits all the notes on Level 2 (the "MUST" criteria).

Here are the missing criteria, all of them from Level 3 (note that I excluded false positives):

Level 3

• OSPS-DO-03.01 — No consumer instructions to verify integrity or authenticity of release assets.
• OSPS-DO-03.02 — No instructions to verify the identity of the person or process that authored a release.
• OSPS-DO-05.01 — No statement of when a release line stops receiving security updates.
• OSPS-QA-02.02 — Releases are not shipped with an SBOM (no CycloneDX/SPDX generation in release workflows).
• OSPS-SA-03.02 — No threat model or attack-surface analysis document.
• OSPS-VM-04.02 — No VEX documents for dependency vulnerabilities that do not affect GitProxy.
• OSPS-VM-05.01 — No documented SCA remediation threshold (tools encode fail-on-severity: high, but that is not a project policy).
• OSPS-VM-05.02 — No documented policy that SCA violations must be addressed before a release.
• OSPS-VM-06.01 — No documented SAST remediation threshold.
• OSPS-QA-04.02 is N/A: GitProxy is a single public source repository (a monorepo that also contains the CLI, website, plugins, and experimental license-inventory). There is no multi-repo release surface to hold to a stricter bar.

Describe the solution you'd like
Fix up our release and security documentation so GitProxy is compliant with all Level 3 criteria.