docs: add a security policy, code of conduct, and code owners

[JustinKovacich]

Why this one matters more than the others

This repository publishes the reusable workflow that simple_doip,
uds_protocol, simple_someip and automotive_wire_codec all call. A change
here executes in their CI. It had no disclosure path at all.

SECURITY.md

States the two facts that make the repo sensitive:

• Consumers pin a mutable tag. Callers use rust-ci.yml@v1, and v1
  moves. Re-pointing it changes every consumer's CI on their next run — no
  action on their part, no review in their repository.
• The release path holds publish credentials. The release-plz jobs consume
  cargo-registry-token, release-plz-app-id, release-plz-app-private-key
  and release-plz-token. A workflow change that misuses those can publish
  crate versions under the org's name.

Scope is written for a workflow rather than a library: script/expression
injection, secret exposure to logs or artifacts or caches, over-broad token
permissions, and cache/artifact poisoning. Vulnerabilities in third-party
actions are explicitly out of scope here and directed upstream.

It also records the current pinning posture — dtolnay/rust-toolchain by
commit SHA, while actions/checkout, actions/setup-python, actions/cache,
Swatinem/rust-cache, taiki-e/install-action, actions/upload-artifact and
codecov/codecov-action are pinned by movable major-version tag. I've written
this as a deliberate trade-off against SHA-pinning churn rather than an
oversight; correct me if that's wrong and it should read as a known gap.

Note on the red check

Pre-commit Checks will fail on this PR. That is the pre-existing mdformat
nit in CHANGELOG.md on main, fixed by #4 — not anything in this branch. I
confirmed mdformat leaves all three new files untouched. It is not a required
check, and goes green once #4 merges.

Verification

pre-commit run --all-files on this branch: 12 hooks pass including zizmor,
actionlint, typos and gitleaks. The only failure is the CHANGELOG.md line
belonging to #4.

🤖 Generated with Claude Code