Add contributing and security policies

[Lauritz-Timm]

Summary

• Add root CONTRIBUTING.md ported from the RTK contributor guide and adapted for ICM.
• Add root SECURITY.md ported from the RTK security policy and adapted for ICM risk areas.
• Document ICM-specific PR base branch expectations, CI checks, test commands, and private vulnerability reporting.

Validation

• git diff --check -- CONTRIBUTING.md SECURITY.md
• Searched the new docs for RTK-only leftovers (RTK, Rust Token Killer, RTK source paths, master, CLA references, discussion links).
• Verified linked local docs and workflow targets exist.

Docs-only change; no cargo test run.

Closes #316