docs: add security extension points guidance

[maxpetrusenkoagent]

Why are these changes needed?

AutoGen is in maintenance mode, but issue #7669 asks where Agent Threat Rules-style content scanning should fit for existing AutoGen users.

This PR adds a docs-only security extension points page that explains the maintainer-shaped path: keep fast-changing threat rule packs outside AutoGen, and compose external scanners at existing message, tool, or workbench boundaries. It specifically calls out that tool and workbench boundaries are better fits than chat-message-only scanning for prompt injection and exfiltration entering through web pages, files, MCP servers, or other tool outputs.

Related issue number

Related to #7669

Verification

• Characterization check before docs change failed as expected: no security-extension-points.md page and no extensions-guide toctree entry.
• python3 characterization check after docs change: PASS: docs coverage for #7669 exists
• uv run python check_md_code_blocks.py docs/src/user-guide/extensions-user-guide/security-extension-points.md passed.
• git diff --check FETCH_HEAD...HEAD passed.
• uv run sphinx-build -b html -W --keep-going docs/src docs/build reached and rendered user-guide/extensions-user-guide/security-extension-points; it still exits non-zero on pre-existing optional dependency autodoc warnings for cv2, chromadb, mem0, redisvl, llama_cpp, ollama, semantic_kernel, graphrag, and json_schema_to_pydantic.

Second-agent review

Preferred reviewer claude -p was available but failed authentication with OAuth access token has been revoked.

Fallback reviewer hermes chat -Q reviewed /tmp/oss-pr-second-agent-review.diff and returned CLEAN: no blocking correctness, regression, test, security, duplicate/superseded, or maintainer-fit issues found.

Checks

• I've included any doc changes needed for https://microsoft.github.io/autogen/. See https://github.com/microsoft/autogen/blob/main/CONTRIBUTING.md to build and test documentation locally.
• I've added tests (if relevant) corresponding to the changes introduced in this PR.
• I've made sure all auto checks have passed.

Created with: Hermes Agent