[Doc] Document bugs vs security vulnerabilities

[alamb]

Describe the enhancement requested

The current security model documented https://arrow.apache.org/docs/dev/format/Security.html

Does not explicitly address what constitutes a bug vs a security vulnerability. We should make this clear

Component(s)

Documentation

[alamb]

Here is a proposal PR:

• GH-49760: Document differences between bugs and security vulnerabilities #49761