Add PR vetting checklist and link #56 from CONTRIBUTING

[smorchj]

Summary

Two related changes to set expectations for incoming contributors:

1. Pre-PR section now lists running tests, linking the closed issue, and one-issue-per-PR — things we already enforce in review but haven't written down.
2. New 'How PRs are reviewed' section explains the bar every PR has to clear: scope matches the description, tests assert what they claim, no silent regressions, no obfuscation, security PRs get a stricter read. Importantly says we don't auto-decline first-time contributors and will leave actionable review feedback rather than closing.
3. 'Good first contributions' section now leads with Generalizability audit — what project types does Klonode fail on? #56 and links the relevant sub-issues by number, so a new contributor can go from CONTRIBUTING.md → tracking issue → sub-issue → PR in three clicks.

Test plan

• Read the file end to end
• Verify all the issue numbers (Add Python, Java, and Ruby export extraction #13, Add PHP support to content extractor #15-19, Detect Remix framework in tool-detector #20-25, Generalizability audit — what project types does Klonode fail on? #56) link to real issues