add PACKAGE.md for System.Formats.Nrbf

[adamsitnik]

95% of the text was copy pasted from https://learn.microsoft.com/dotnet/standard/serialization/binaryformatter-migration-guide/read-nrbf-payloads

5% from the Threat Model doc

fixes #103481

[terrajobst]

Left some feedback, but this looks great!

I assume PACKAGE.md is a magic name that nuget.org uses to render as the README?

[adamsitnik]

I assume PACKAGE.md is a magic name that nuget.org uses to render as the README?

My understanding is that we don't use README.md name because we already had such files (they are often used for providing docs specific to our repo). I expect some magic MSBuild check like this one ensures that it works fine with NuGet:

runtime/eng/packaging.targets

Lines 24 to 26 in bfd964a

	<!-- PackageReadmeFile specifies the package readme file name in the package. PackageReadmeFilePath points to the package readme file on disk. -->
	<PackageReadmeFile Condition="'$(PackageReadmeFile)' == '' and '$(EnableDefaultPackageReadmeFile)' == 'true'">PACKAGE.md</PackageReadmeFile>
	<PackageReadmeFilePath Condition="'$(PackageReadmeFilePath)' == '' and '$(EnableDefaultPackageReadmeFile)' == 'true'">PACKAGE.md</PackageReadmeFilePath>