[docs] Add security boundaries reference in SECURITY.md (#17848)

## Summary
1. Add a Security Boundaries section to `SECURITY.md`.
2. Point readers to the Codex Agent approvals and security documentation
for sandboxing, approvals, and network controls.

## Validation
1. Reviewed the `SECURITY.md` diff in a clean worktree.
2. No tests run. Docs only change.

codex-rs/app-server/BUILD.bazel

@@ -3,6 +3,9 @@ load("//:defs.bzl", "codex_rust_crate")
 codex_rust_crate(
     name = "app-server",
     crate_name = "codex_app_server",
+    integration_test_tags_extra_by_stem = {
+        "all": ["flaky"],
+    },
     integration_test_timeout = "long",
     test_tags = ["no-sandbox"],
 )