[goroyabu]

Summary

• add contributor guidance covering project scope, workflow, verification, packaging, documentation, CI, and releases
• add a security policy using GitHub private vulnerability reporting
• add focused Issue forms and a pull request template, with README links to the new guidance
• align the documented merge workflow with the repository setting that permits merge commits only

Related Issue

Closes #16

Verification

• git diff --cached --check completed without errors before the commit
• all Issue-form and workflow YAML files were parsed successfully
• referenced tracked files and relative documentation links were checked
• confirmed the bug and enhancement labels exist
• confirmed private vulnerability reporting is enabled
• confirmed repository description and topics are set
• confirmed merge commits are the only allowed pull request merge method
• build and CTest were not run because this change affects documentation, templates, and repository policy only

Impact

No build, runtime, installation, or package behavior changes. Contributors receive explicit workflow and reporting guidance, and GitHub now presents structured Issue and pull request forms.

Documentation

Adds CONTRIBUTING.md and SECURITY.md, and links both from the README.

Checklist

• The change is focused on one coherent maintenance outcome.
• Relevant local verification has been run and reported above.
• User-facing workflows and supported behavior are documented when changed.
• No downloaded upstream archives, extracted vendor sources, build outputs, or generated files were committed unintentionally.