Add CONTRIBUTING.md and SECURITY.md

[Lauritz-Timm]

Problem

The repository is missing standard contributor-facing governance files:

• CONTRIBUTING.md
• SECURITY.md

This makes it harder for new contributors to understand how to set up the project, run tests, target the right branch, and report security issues responsibly.

Suggested scope

Add CONTRIBUTING.md covering:

• development setup
• branch and PR target expectations
• local test commands
• commit and PR guidance

Add SECURITY.md covering:

• supported versions, if applicable
• responsible disclosure process
• what information to include in a vulnerability report
• expected response process, if known

Acceptance criteria

• CONTRIBUTING.md exists at the repository root.
• SECURITY.md exists at the repository root.
• Contributor docs mention the expected PR base branch.
• Security policy gives a clear private reporting path.

[Lauritz-Timm]

I picked this up and ported the RTK docs to ICM here:

#317

What changed:

• added CONTRIBUTING.md
• added SECURITY.md
• adapted RTK-specific content to ICM's Rust workspace, memory/MCP scope, develop PR base, CI checks, and security-sensitive areas
• removed RTK-only references and avoided GitHub Discussions links because Discussions are not enabled on rtk-ai/icm

Validation:

• git diff --check -- CONTRIBUTING.md SECURITY.md
• searched for RTK-only leftovers
• verified linked local docs/workflow targets exist

Docs-only change, so no cargo tests were run.