Add reference to security analysis

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2025-01-22

The FAPI2 security analysis linked from https://openid.net/security-analysis-fapi-2-0-completed/ includes a security analysis of FAPI-CIBA, so we should include a link to it in the FAPI-CIBA spec.

---

Bitbucket status: new

Bitbucket origin: issue 730

[sakimura]

We should fix it and take FAPI-CIBA to the final. Both ConnectID and Brazil is trying to deploy it.

[jogu]

I actually did this Nat, hope that's ok - #861