docs: publish security review and remediation for contract sandbox escape

[SIDDHANTCOOKIE]

Summary

• Publishes the security review that found the Critical sandbox-escape vulnerability fixed in fix: close contract sandbox escape via str.format() attribute traversal #152 (str.format() attribute-chain traversal bypassing the AST dunder blocklist in minichain/contract.py).
• Publishes the matching remediation report confirming commit 3ca9596 (merged via fix: close contract sandbox escape via str.format() attribute traversal #152) implements the review's recommendation.
• Moves both files from the private, gitignored unremediated-security-reviews/ folder into the public, tracked security-reviews/ folder, per the security-remediation skill workflow added in chore: add security-review and security-remediation skills #153.

Test plan

• Documentation only, no code changes.
• Confirmed unremediated-security-reviews/ no longer contains either file after the move.

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
minichain
__init__.py	10	0	100%
block.py	92	1	99%	14
chain.py	227	39	83%	182–185, 195–196, 205–206, 209–210, 214–215, 234, 258, 266–274, 283–284, 286–287, 310–313, 316–325, 335–336
contract.py	171	32	81%	39–42, 74–84, 89–93, 105–112, 218–220, 240–241
identity.py	24	0	100%
mempool.py	65	3	95%	32–34, 56
mpt.py	14	0	100%
network_config.py	10	0	100%
node_config.py	11	0	100%
p2p.py	365	234	36%	89, 92, 98, 125–143, 146–147, 150–151, 164–170, 198, 206–208, 211, 214, 221–222, 226–227, 256–257, 271–277, 290, 300, 304–306, 319–320, 333–351, 359–377, 387–403, 408–592
persistence.py	195	0	100%
pow.py	43	0	100%
receipt.py	14	0	100%
rpc.py	82	1	99%	91
serialization.py	8	0	100%
state.py	214	0	100%
transaction.py	59	0	100%
validators.py	9	0	100%
TOTAL	1613	310	81%

Tests	Skipped	Failures	Errors	Time
230	0 💤	0 ❌	0 🔥	12.612s ⏱️