Add vulnerability SLA, mentorship, welcome, and office hours community docs

[Maryermarh]

Summary

Adds four community and security-liaison governance documents, all self-contained
inside Governance/. Each is a versioned policy with an owner, review cadence,
and change log, consistent with the existing Governance/ documents.

File	Covers
Governance/policies/VULN_SLA.md	Remediation targets per severity, measurement, and escalation when a target is missed.
Governance/community/MENTORSHIP_PROGRAM.md	How mentors and mentees are matched, expectations, duration, and review.
Governance/community/WELCOME_GUIDE.md	First steps, key resources, and where to get help for newcomers.
Governance/community/OFFICE_HOURS.md	Schedule, hosting, how topics are submitted, and follow-up.

Scope

• Documentation only. No TypeScript, configuration, schema, or dependency is
  touched.
• All changes live under Governance/; nothing outside Governance/ is modified.
• Governance/ is outside the Jest root and the TypeScript build, so no test,
  build step, or runtime path is affected.

Notes

• Regression tests are not applicable: this is a documentation-only change with
  no executable code.
• Cross-references point at existing Governance/ documents
  (SECURITY_POLICY.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md,
  processes/ONBOARDING.md, and others).

Closes #1850
Closes #1861
Closes #1863
Closes #1864

[drips-wave]

@Maryermarh Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project.