Refactor project-coordinates: security_model_link and AI-friendly sources

[ppkarwasz]

Renames the link field in scripts/project-coordinates.json to security_model_link, and adds a security_model_source field pointing at an AI-friendly plain-text (raw GitHub) version of each security page. The source is not rendered on the site; it is there for external tooling that prefers text over HTML.

Changes

• Add scripts/project-coordinates.schema.json (JSON Schema; the six core fields are required) and reference it from the data file via a $schema key. The page generator and the DOAP cross-check now skip $-prefixed meta keys.
• Normalize every entry to carry the six core fields (null when absent); default the one missing contact to security@apache.org.
• Fill security_model_source from raw.githubusercontent.com for GitHub-hosted security pages.
• Normalize GitHub SECURITY.md entries to the canonical /security/policy human link, with the raw SECURITY.md as the source. Entries pointing at other files (THREAT_MODEL.md, *.adoc, deep paths) keep their blob link+source.
• Regenerate the affected overview and project pages (activemq, httpd, impala, superset security-page links).

Verification

• All 214 entries validate against the new schema; IDE reports no diagnostics.
• Every GitHub link and source URL was checked and returns HTTP 200.
• Scripts py_compile clean; the generator was re-run to produce the page changes.

🤖 Generated with Claude Code

[raboof]

seems reasonable to me.

starting to feel like we'd want to leave out fields that match 'the default' in project-coordinates.json

[potiuk]

Question: Is that work coordinated with .asf.yaml changes ? https://github.com/apache/infrastructure-asfyaml/pull/105/changes

[ppkarwasz]

Cool, I didn't know apache/infrastructure-asfyaml#105 was merged! I believe this answers the question about coordination. 😆

In the long run the plan is obviously to use ATR to download the missing data, but currently there is still a granularity problem: project-coordinates has a PMC granularity, while ATR has a project/repo granularity. I am not exactly sure how to conciliate those.

[ppkarwasz]

I can test if project data is synced to ATR, after apache/commons-imaging#555 is merged.