docs: add the security policy, code of conduct, and contributing guide

[JustinKovacich]

Commit Message Details

Four files an outside contributor expects and this repository did not have:
SECURITY.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, .github/CODEOWNERS.

SECURITY.md is written for a UDS codec specifically rather than as
boilerplate, so reporters can tell a defect from the protocol working as
designed:

• UDS carries no transport security — ISO 14229 is a service layer.
• SecurityAccess (0x27) is a seed/key unlock, not authentication, and its
  strength lives in the ECU's key algorithm. Authentication (0x29) and
  SecuredDataTransmission (0x84) are not implemented here.
• RequestDownload/RequestUpload/TransferData/RequestFileTransfer write
  to the ECU by design; gating who may send them is the ECU's job.

In scope: panics, out-of-bounds reads, unbounded allocation, decodes accepting
frames they should reject, hangs reachable from the wire.

CONTRIBUTING.md documents the layered feature graph (std → alloc;
utoipa/clap → std; utoipa → serde), what each of the three
integration tests guards, and the fuzz targets. It describes the merge
behaviour the repo actually has: allow_squash_merge is false and the
ruleset permits merge only, so branch commit subjects land on main and feed
release-plz — not the PR title.

CODE_OF_CONDUCT.md is Contributor Covenant 2.1. Enforcement contact is
envision-dev@microvision.com — flagging for review, since this would be
the first non-author email published in the repo.

CODEOWNERS is * @luminartech/luv, routing only; the ruleset does not
require code-owner approval, so nothing about merging changes.

Noticed but not changed

.github/workflows/pr-lint.yml says "Squash-merge (see repo settings) uses the
PR title as the commit message". That comment is stale — squash merge is
disabled on this repo. Left alone rather than folding a CI change into a docs
PR; worth a follow-up to correct the comment or re-enable squash merge.

I also created the No Issue label, which this repo's own pr-lint.yml
references but which did not exist.

Issue URL

No associated issue — part of an open-source readiness sweep across the public
crates (simple_someip#157, rust_workflow#4/#5, simple_doip#19,
automotive_wire_codec#14). Labelled No Issue.

Testing

• pre-commit run --all-files passes on the branch — 14 hooks, including
  mdformat, typos, gitleaks, cargo fmt and cargo check.
• Documentation-only change: no source files touched, so no runtime behaviour
  to exercise. The CONTRIBUTING.md feature-graph and merge-behaviour claims
  were each checked against Cargo.toml, the repo merge settings
  (allow_squash_merge: false) and the ruleset's allowed_merge_methods
  rather than copied from a sibling repo.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

@@            Coverage Diff             @@
##             main      #56      +/-   ##
==========================================
- Coverage   90.33%   89.93%   -0.40%     
==========================================
  Files          31       31              
  Lines        5523     5523              
==========================================
- Hits         4989     4967      -22     
- Misses        534      556      +22