Add contributor agreement for contributors

[brianmhunt]

Alternatives include https://cla-assistant.io/

Note clahub/clahub#111

[knockout-triage-server]

I originally implemented the CLA using clahub but reverted when I
discovered that it required getting permissions to do all kinds of things
using your GitHub account (for example, it could read/write arbitrary repos
as you).

Do you know if they have changed it to not require anything beyond
verifying your identity?

[brianmhunt]

I think those levels of permissions are part and parcel with those integrations, it seems.

The way to protect ones private repos would be to set up an organization, which gives more granular access i.e. you can specifically disable all third party access until explicitly granted for each integration.

[SteveSanderson]

It wasn't just that clahub required giving it permission to the Knockout repos. It also required everyone who used it to sign the CLA to give it full access to their GitHub accounts. That seems completely mad to me - I know I'd certainly not grant it such permissions - I don't think signing any CLA would be important enough to justify doing that. Maybe this has changed.

[brianmhunt]

@SteveSanderson Oh yes, I see. That is madness. I like the concept, but yes... madness. :) Will try to look into it and post back here.

[brianmhunt]

Incidentally, this came to mind because I went through a similar process when contributing a PR to Karma via karma-runner/karma#1513