docs(security): update static files examples to use StaticFilesMiddleware service (closes #345)

[s2x]

Description

Closes #345

Changes

• Updated Static Files Protection section:
  • Changed intro text to describe service registration pattern instead of the deprecated serve_files server option
  • Updated Extension Allowlist YAML example to use StaticFilesMiddleware service with and constructor arguments
  • Updated Symlink Protection YAML example to use StaticFilesMiddleware service with and constructor arguments
  • Updated Security Considerations to reference and instead of deprecated root_dir and follow_symlinks
• Added CHANGELOG.md entry under [Unreleased] → Docs

Acceptance Criteria

• README no longer presents serve_files as a current feature (was already fixed by [Docs] README 'What's new in this fork' is stale (advertises deprecated serve_files) #268 and [Docs] README example demonstrates deprecated serve_files-style static serving; StaticFilesMiddleware replacement never shown #342)
• The deprecation status matches the code (serve_files and root_dir are deprecated since 0.9.3)
• No remaining contradiction between docs and @deprecated annotations in src/
• CHANGELOG.md entry added under [Unreleased]

Code Review

• Passed code review
• All review comments addressed