docs: add query_history redaction checklist

[sionsmith]

Task

Document how users should redact QUERY_HISTORY exports before attaching examples to issues or sharing benchmark data.

Likely files

• SECURITY.md
• docs troubleshooting or replay simulator page

Acceptance criteria

• Checklist covers query text, account identifiers, usernames, roles, warehouses, database/schema/table names, and timestamps.
• The checklist says security reports should stay private.