Add student SGU profile synchronization

docs/security.md

@@ -32,10 +32,15 @@
 
 - Administrative enrichment reads only employee number, display name,
   employee type/status, email, job title, and department from known element IDs.
+- Student enrichment reads only the matching student number, given names,
+  paternal/maternal surnames, email, career, street, neighborhood,
+  city/municipality, state, and postal code from known element IDs.
+- Student CURP, birth date, sex, blood type, marital status, telephone, mobile,
+  guardian, medical, financial, and academic-history values are ignored.
 - Incident details, calendars, photographs, manager names, and manager positions
   are deliberately ignored.
-- The employee number must match the authenticated `AD` key before metadata is
-  synchronized.
+- The employee or student number must match the authenticated `AD` or `AL` key
+  before metadata is synchronized.
 - If SGU changes its HTML, authentication and exact-password synchronization
   continue without enrichment; existing AD metadata is not erased.