Third-party red-team reports

Signed, RFC 3161 timestamped chain-of-custody for adversarial-testing deliverables uploaded by third-party vendors (Lakera, HackerOne, internal red team, etc.).