Update CONTRIBUTING.md

Disclosure policy should really be up here, so fixing that.