Touch up Security Posture section

The biggest change is to upgrade the section on `allowed_functions` generally
and following the recent tightening of that logic.  The rest of the changes are
mostly reorganizations of the existing text.

[sc-34267]