Add SECURITY.md and CONTRIBUTING.md; set the crates homepage

[maykonlma]

Community-health files, needed before the repo goes public, plus one metadata field for crates.io.

• SECURITY.md — routes vulnerability reports to a private channel (GitHub advisories / signed
  email), so a hash divergence or a validator bypass is never disclosed in a public issue. Spells out
  what counts as a vulnerability here: a wrong hash, malformed input that gets hashed instead of
  refused, a panic on untrusted input, an unsafe surface (only the opt-in yaml feature has one).
• CONTRIBUTING.md — this is the reference implementation, so it states the rule plainly: when
  the crate and the spec disagree, the spec wins. A hash-affecting change belongs in the protocol repo;
  the conformance vectors are a mirror and are not edited here.
• homepage = "https://ledvar.org" on the workspace and all three crates — the project link
  crates.io shows.

Docs and metadata only. No source, no behaviour, no hash affected — the three crates build
byte-identically.

Note: the v0.1.0 tag and its draft release were dropped and will be re-cut from main after this
merges, so the signed artifacts match the published tree exactly