docs: add LLM08 retrieval authorization gates

[catcherintheroad-hub]

Created from review issue: #1384

Summary

• Add LLM08 retrieval authorization evidence gates for RAG pipelines.
• Require pre-query filters, post-retrieval ACL checks, cache scoping, reranker metadata preservation, permission-change invalidation, public-content classification, and prompt assembly boundaries.
• Add output fields and edge-case fixtures for tenant-filter-only retrieval, shared cache leakage, reranker ACL metadata loss, and complete authorization chains.

Validation

• git diff --check
• Markdown fence/non-ASCII sanity check
• Reference URL checks for OWASP LLM08, OWASP LLM Top 10, and NIST AI RMF