docs(security): rewrite .bestpractices.json to canonical autofill schema (RAN-58) (#47)

Rewrite `.bestpractices.json` from the custom group structure
(status / evidence / audit) to the flat per-criterion schema that
bestpractices.dev's autofill robot reads, so the board can flip
project 12646 to `passing` without hand-typing 67 answers.

- 67 canonical criteria from criteria.yml `'0':` block (43 MUST,
  10 SHOULD, 14 SUGGESTED)
- 65 Met + 2 honest N/A: crypto_password_storage (no password
  storage; bearer-token auth only) and dynamic_analysis_unsafe
  (Go is memory-safe; no unsafe.Pointer in app code)
- All 8 url-required criteria carry `_url` evidence
- Meta fields preserved: project_id, name, description,
  homepage_url, repo_url, license, level: "passing"
- Add CONTRIBUTING.md to back the `contribution` MUST plus the
  test / lint / signed-commit policy criteria honestly

Refs: RAN-58
Schema: coreinfrastructure/best-practices-badge:docs/bestpractices-json.md

Co-authored-by: Paperclip <noreply@paperclip.ing>

Author: aksOps