Shift-left: catch it while it's still cheap

Defines shift-left as moving security earlier on the SDLC timeline and grounds it in the cost-of-a-bug curve.