doc that vendor/upstream URLs are preferred

(unfortunately adding words to CONTRIBUTING.md again)
Merge pull request #3212 from rolandwalker/doc_vendor_url

doc that vendor/upstream URLs are preferred