chore: open-source community health files

[AThraen]

Summary

Sets up the standard set of community-facing docs and templates so CSM is well-positioned for outside contributors and shows a complete community-health checklist on GitHub.

Why

Currently the repo has README + LICENSE + CI but no contributing guide, no code of conduct, no security policy, no issue templates, no PR template, no Dependabot. Anyone landing on the repo has to guess at the contribution process, and there's no private channel for security reports.

What's added

File	Purpose
.github/CODE_OF_CONDUCT.md	Adopts Contributor Covenant 2.1 by reference (linked, not vendored). Contact: thraen@gmail.com.
.github/CONTRIBUTING.md	Build/test instructions, --clean flag for safe lifecycle testing, branch + commit naming derived from the existing git log, PR expectations, label conventions, code-style notes pointing to CLAUDE.md.
.github/SECURITY.md	Supported versions table, private reporting via GitHub Security Advisories or thraen@gmail.com, scope notes for the local desktop surface.
.github/ISSUE_TEMPLATE/bug_report.yml	Issue form with version / OS / dotnet / CLI / crash.log fields. Auto-labels bug.
.github/ISSUE_TEMPLATE/feature_request.yml	Problem / proposed solution / alternatives / mockups form. Auto-labels enhancement.
.github/ISSUE_TEMPLATE/config.yml	Disables blank issues; points questions to Discussions and security reports to the advisory channel.
.github/PULL_REQUEST_TEMPLATE.md	Summary / Why / Implementation notes / Test plan / Screenshots — matches the pattern in recent merged PRs.
.github/SUPPORT.md	Short index of where to ask what (Discussions vs issue templates vs security).
.github/dependabot.yml	Weekly nuget + github-actions updates, grouped per ecosystem, capped at 5 open PRs each.

Implementation notes

• CoC is by reference, not vendored. GitHub still recognises a CODE_OF_CONDUCT.md that points to the canonical Contributor Covenant URL and shows the community-health checkmark.
• No new labels invented. Templates only use bug and enhancement, which already exist; Dependabot's dependencies is auto-applied.
• No FUNDING.yml — there's no sponsor / OpenCollective / etc. set up. Easy to add later if that changes.
• No npm dependabot entry — there's no package.json (xterm.js assets are vendored under Assets/).

Test plan

• After merge, GitHub's Insights -> Community Standards page should show all checklist items satisfied
• New issue page presents the two forms (Bug / Feature) plus the Discussions / Security advisory contact links, with no blank-issue option
• New pull request populates the body with the PR template
• Dependabot opens its first batch of grouped PRs on the next Monday after merge
• No runtime files touched; build remains green