docs: epic for explicit aidd-security-review skill (mandatory /review pass)

[ericelliott]

Summary

Adds a planned task epic to introduce aidd-security-review: a checklist-driven security skill that /aidd-review must invoke so first-pass reviews catch structural auth/secret failures without relying on OWASP alone.

Epic file

• tasks/aidd-review-explicit-security-skill-epic.md

Updates

• Overview reframed around least knowledge, least privilege, security in layers, and prefer the safer option (explicit Principles section).
• Removed condescending / leading phrasing about “absolutist fiction.”
• Author task now requires the new skill to open with that Principles block.

Follow-up work (in the epic)

• New .cursor/skills/aidd-security-review/SKILL.md with explicit checklist + principles.
• Wire into aidd-review (.cursor + ai/skills copies).
• References with bad/good pattern pairs.
• Cross-links from AGENTS.md / agent entry points.

This PR tracks the epic document; implementation is subsequent tasks per the epic.