docs: add SECURITY.md and CONTRIBUTING.md

[dhensby]

Summary

Adds two community health docs so the project has clearly defined, easy-to-follow guidance for security researchers and contributors. Neither existed before, and there is no org-level .github repo providing defaults.

Both docs were modelled on established examples (Node.js, Sequelize, GitHub's recommended templates) and tailored to node-mssql's actual conventions.

SECURITY.md

• Supported Versions — security fixes for the latest major line (12.x) only, with an upgrade pointer.
• Reporting a Vulnerability — routes reporters through GitHub private vulnerability reporting (with a direct "Report a vulnerability" link), explicitly discourages public issues/PRs/discussions, and offers a no-details fallback.
• What to include — impact, affected version(s), driver (tedious/msnodesqlv8), repro steps, PoC, and mitigations.
• What to Expect — honest, community-project response timelines (3 business days to acknowledge, 10 to assess).
• Coordinated Disclosure — confirm → fix + CVE/advisory → release with credit.
• Scope — clarifies node-mssql vs. tedious/SQL Server, and lists out-of-scope cases.
• Recognition — credit unless the reporter prefers anonymity.

Private vulnerability reporting has been enabled on the repo, so the "Report a vulnerability" link in the policy is live.

CONTRIBUTING.md

• Reporting issues — points security reports at SECURITY.md, and documents the bug/feature-request expectations.
• Development setup — Node.js >= 18.19.0, npm install, and a table of the test scripts (npm test, test-unit, test-tedious, test-msnodesqlv8, test-cli) plus how to run a single test and the dev-container note for integration tests.
• Coding standards — StandardJS, the driver-agnostic lib/base vs. driver-impl layout, dual Promise/callback API, and test placement.
• Commit messages — Conventional Commits with a type → release-impact table (commitlint + semantic-release enforced).
• Pull requests — branch from master, atomic commits, rebase (not merge) to stay current, merge-commit strategy, and the PR checklist.

Not included

A Code of Conduct was intentionally left out for now given the size of the community; it can be added later via GitHub's template flow if that changes.