Flesh out CONTRIBUTING.md and SECURITY.md

[JobDoesburg]

What this does

Brings the two root-level community docs up to the same standard as the rest of the repo.

CONTRIBUTING.md

The existing version was actually pretty good (modular-apps rule, services pattern, migrations, fixtures, time zones, CSP, sensitive apps, privacy, testing, code style — all already there and accurate). The weakness was the bottom: a 3-bullet workflow that didn't tell a new contributor what their first PR should actually look like.

Additions:

• Quick start with a concrete checklist (set up locally, branch, make the change, run the actual lint/test/schema-validate commands, open the PR). Replaces the bare 3-bullet workflow.
• Opening a pull request section spelling out what makes a good PR: one concern per PR, descriptive body, regression test for fixes, migration in the same commit, don't squash other people's commits, don't force-push to master or --no-verify past hooks.
• Reviewer checklist — scope check, app isolation, migrations, sensitive-app coverage, PII, vendored frontend, CI green. Makes the implicit explicit and gives reviewer and contributor a shared bar.
• AGENTS.md pointer at the top — same conventions, condensed for AI coding tools. Was easy to miss before.
• SECURITY.md pointer from the sensitive-apps section so the reader knows the right disclosure path.
• pydocstyle added to the listed code-style tools — CI already runs it.

Existing content kept verbatim.

SECURITY.md

Promoted from a 9-line stub to a real disclosure policy.

• Supported versions — only the current deployment at https://tosti.science.ru.nl and the TOSTI-fridge-client repo.
• Reporting a vulnerability — don't open a public issue; email www-tosti@science.ru.nl; what to include in the report; expect an acknowledgement within 7 days; escalation path at 14 days.
• What counts as a security issue with explicit in/out-of-scope lists. In: auth/scope bypasses, age-verification bypass (legally loaded), OAuth/MCP issues, SAML issues, privacy leaks, injection classes, secret leakage, supply chain. Out: cosmetic issues, third-party domains, unverified scanner output.
• What we ask of reporters — don't pivot once you've demonstrated the issue, don't unnecessarily test in production, coordinate disclosure timelines.

Test plan

• Render both files on GitHub and confirm the headings, code blocks, and the new > [!IMPORTANT] callout in CONTRIBUTING.md display correctly.
• Check that all in-repo links resolve (AGENTS.md, SECURITY.md, deploy/README.md, README.md anchors).