security: triage 54 audit findings from abandoned clone (#28)

[jacobyoby]

Triaged all 54 security findings from the abandoned docassemble-fix clone.

Triage results:

• Fixed: 4 (C-5 tar-slip, H-5/H-6 path traversal, M-15 safe_join)
• Upstream design: 6 (C-1, C-6-C-9, M-17 core engine architecture)
• Open: 46 findings requiring attention

22 GitHub issues created with security label:

• 6 critical (PRNG, deserialization, SSRF, etc.)
• 16 high (auth bypass, injection, etc.)
• Medium grouped logically
• 8 low findings consolidated

Stored: .github/SECURITY_AUDIT_TRIAGE.md with full per-finding status.

Closes #28.

Generated with Qwen Code