Define basic repository guidelines

[endocrimes]

• License requirements
• CI/CD
• SLSA?

[calebschoepp]

@endocrimes I have some questions here:

• Do we have a preferred license or do we just care that people use a license?
• What did you have in mind for CI/CD? Are we just saying something like "make sure you have CI/CD that runs some tests"?
• Are we good to just punt on SLSA as relatively small project? If we did do SLSA what would that entail for this document?

[calebschoepp]

@endocrimes ping