docs: establish contributor, conduct, security, and support policies

[baokhang83]

Goal

Make it clear how people can contribute, receive respectful treatment, report vulnerabilities privately, and ask for help.

Scope

• Add CONTRIBUTING.md with local build/test prerequisites, contribution paths, and pull-request expectations.
• Add CODE_OF_CONDUCT.md with an enforcement contact.
• Add SECURITY.md with a private vulnerability-reporting channel, disclosure expectations, and response process.
• Add a documented support path or issue template for non-security user questions.
• Link these documents from the README.

Acceptance criteria

• A first-time contributor can find each policy from the repository homepage.
• Security reports are directed away from public issues.
• The policies are consistent with the Apache Maturity Model gaps noted in MATURITY.md (CO10, CO20, QU30).