doc that vendor/upstream URLs are preferred

(unfortunately adding words to CONTRIBUTING.md again)