tracking: Clarify security boundaries in our security policy

Some parts of Anchor are considered defense-in-depth/anti-footgun measures and don't constitute a security boundary. We should clarify these so reports can be filed in the correct way.