docs: add security severity rubric to Governance

[PHADAR6]

Overview

This PR closes a governance gap in the Governance/ folder by adding a versioned Security Severity Rubric document. It defines severity levels, per-level criteria, and response SLAs so contributors and maintainers have a single reference for triaging security issues in the TeachLink Backend.

Related Issue

Changes

📄 Governance Documentation

• [ADD] Governance/SECURITY_SEVERITY_RUBRIC.md

  • Documents the severity levels used for security triage.
  • Specifies the criteria that qualify an issue for each level.
  • Defines the response SLA per level.

• [MODIFY] Governance/CHANGELOG.md

  • Records the addition of the new rubric document.

Verification Results

Documentation-only change:
✅ Governance/SECURITY_SEVERITY_RUBRIC.md added
✅ Governance/CHANGELOG.md updated
✅ No source files modified

Acceptance Criteria	Status
Governance requirement is implemented successfully	✅ Rubric document added under Governance/
Scope is limited to a maximum of two files	✅ Two files changed
No changes are made outside the Governance folder	✅ All changes confined to Governance/
No regression in existing functionality	✅ Docs-only change; no code paths touched
Tests pass and code follows project standards	✅ No test surface affected by this change
Change is documented	✅ Governance/CHANGELOG.md updated

Closes #1617

[drips-wave]

@PHADAR6 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits