Add CONTRIBUTING and SECURITY policy

[tanyaroosta]

Summary

Adds two community-health / OSS-readiness files flagged as missing on this public repo:

• CONTRIBUTING.md - how to report issues, set up a dev environment (pip install -e .), branch/PR workflow, DCO sign-off (git commit --trailer "Co-authored-by: Cursor <cursoragent@cursor.com>" -s), coding guidelines, and licensing of contributions (Apache-2.0).
• SECURITY.md - how to privately report vulnerabilities via GitHub Private Vulnerability Reporting (and AMD PSIRT), what to include, response commitments, and supported versions.

Both are tailored to primus-mllog (ROCm Primus / MLPerf logging) and reference the existing .github/CODEOWNERS and LICENSE.

Notes

• No code changes; docs only.
• Consider also enabling Private Vulnerability Reporting under Settings -> Advanced Security so the SECURITY.md "Report a vulnerability" flow is active.

Test plan

• Confirm both files render correctly on GitHub.
• Verify Insights -> Community Standards now shows Contributing and Security policy as satisfied.

Made with Cursor