docs: add a security model page for users

Readers asked whether the client can be trusted with their files. The
threat model in ARCHITECTURE.md is written for contributors, so
docs/SECURITY_MODEL.md summarises it for users: encryption comes from
the SDK and rPGP, sign-in uses SRP, what is stored where and how it is
protected, who can reach the daemon, every network connection, what the
client does not protect against, and how each package is built and
signed. It says that there has been no independent audit.

It is linked from the README, the documentation index and SECURITY.md.

SECURITY.md

@@ -4,6 +4,9 @@
 
 Fixes land on the latest release. Please reproduce on the most recent version before reporting.
 
+For what the client protects and what it does not, written for users, see the
+[security model](docs/SECURITY_MODEL.md).
+
 ## Reporting a vulnerability
 
 **Do not open a public issue.** Report privately through GitHub's