Add security governance files

[pdettori]

Summary

• CODEOWNERS — Default ownership to @kagenti/maintainers, CI/platform config to @kagenti/admins
• SECURITY.md — Vulnerability reporting via GitHub Security Advisories, response timeline, documents deployed security controls (Trivy, CodeQL, Dependabot, Scorecard, action pinning)
• CONTRIBUTING.md — Development setup, PR process, conventional commit format, DCO sign-off requirement, code style guide
• Root .gitignore — Secret/credential patterns (.env.*, *.key, *.pem, *kubeconfig*), IDE/OS files, ruff cache

LICENSE (Apache 2.0) already exists — verified, no changes needed.

Depends on #6 (CI) → #5 (tests) → #4 (pre-commit).

Recommended branch protection rules for main

These cannot be applied via PR and should be configured manually:

• Require PR reviews (minimum 1 approval)
• Require status checks to pass: lint-and-test, dependency-review, trivy-scan, codeql
• Disable force push to main
• Require branches to be up to date before merging
• Require conversation resolution before merging

Test plan

• Verify CODEOWNERS assigns correct reviewers on PR
• Verify SECURITY.md links to correct security advisory URL
• Verify .gitignore blocks secrets (create .env.test and confirm it's ignored)

🤖 Generated with Claude Code