docs: add security and community guidelines

[aaf2tbz]

Summary

Add the community health documentation GitHub expects for security reporting, contributor conduct, and project contributions. The policies are tailored to MetalSharp's private vulnerability reporting flow, Apple Silicon development requirements, and existing PR readiness gates.

Changes

• Add a security policy covering supported versions, private reporting, response expectations, and vulnerability scope.
• Add Contributor Covenant 2.1 with a private enforcement contact and community impact guidelines.
• Add contribution guidance for setup, change scope, validation, pull requests, and compatibility reports.
• Keep all three files under .github/ so GitHub discovers them without adding root-level files.

PR Readiness (MANDATORY)

• Compatibility verified with at least one real game (game + launch method noted below)
• No hardcoded paths, secrets, or absolute /Users/... paths introduced
• Config/rules TOML validated if configs/mtsp-rules.toml or DLL maps changed
• Version triple (CMakeLists.txt, Cargo.toml, package.json, package-lock.json) in sync if version bumped
• Bottle/runtime migration and launch behavior preserved (rollback plan noted if changed)
• Docs / compatibility matrix updated for user-facing changes
• Regression test added for each bug fix

Bypassed intentionally via checklist-exception: this PR adds documentation only. It does not change game compatibility, configs, DLL maps, versions, bottle/runtime behavior, or executable code, and it does not fix a runtime bug.

Local toolchain (run before push)

• git diff --check passes
• Prettier passes for all three Markdown files
• GitHub private vulnerability reporting is enabled for the security advisory link
• No hardcoded secrets or machine-specific absolute paths introduced
• No new files added to the repository root; community files are under .github/
• Rust, C++, TypeScript, shell, config, and release-tooling gates not run because those areas are unchanged
• Game launch testing not run because runtime behavior is unchanged

Test notes

Validated Markdown formatting with the repository-installed Prettier and checked the staged diff for whitespace errors. Reviewed all relative repository links and verified that GitHub private vulnerability reporting is enabled. No build or game test is applicable to this documentation-only change.

Risk

Low. This PR changes documentation only. The main risk is inaccurate or unclear community guidance; rollback is reverting the commit.