OSS hygiene: add community files, dependabot, and security scanning

[whywaita]

Problem

Standard OSS operational files and automation are missing.

Community files (all absent under .github/)

• SECURITY.md — no vulnerability-reporting channel is defined.
• CONTRIBUTING.md (only a few lines in README), CODE_OF_CONDUCT.md
• .github/ISSUE_TEMPLATE/, .github/PULL_REQUEST_TEMPLATE.md

Dependency automation

• No .github/dependabot.yml or renovate.json. Go modules and Action versions are updated manually. (GitHub already reports open Dependabot alerts on the default branch.)

Security scanning

• No CodeQL, govulncheck, or trivy workflow in .github/workflows/.

Suggested fix

• Add SECURITY.md (with a private reporting path), CONTRIBUTING.md, CODE_OF_CONDUCT.md, and issue/PR templates.
• Add dependabot.yml for gomod and github-actions.
• Add a CodeQL and/or govulncheck workflow.

[whywaita]

Data point for the security-scanning item: govulncheck ./... currently reports reachable findings, notably GO-2026-4762 in google.golang.org/grpc v1.77.0 (fixed in v1.79.3; reachable via the shoes-provider gRPC path) plus two stdlib findings fixed by building with the latest Go patch release. A govulncheck workflow would have surfaced these automatically, and dependabot.yml (gomod) would open the grpc bump on its own.