Add a basic contribution guide

This is mostly copied from how it works for cryptography, as @exarkun requested.

There should perhaps be a way to send in security vulnerability reports, but there's no reason that has to happen on this PR.