Update Security model documentation to explain our approach for sensitive data exposure over API

### Body

We should update the security model to explain the policy around exposing the sensitive data.

### Committer

- [x] I acknowledge that I am a maintainer/committer of the Apache Airflow project.

Locate the security model documentation and review its current guidance on sensitive data exposed through APIs. Confirm the project’s policy with maintainers, then update the relevant documentation so the approach and boundaries are explicit; done means the policy is documented and reviewable.

Written by the indexing model from the issue text.