Docs: contribute-all + custom-button contributions

[foodlbs]

Summary

Catches CONTRIBUTING.md and SECURITY.md up with the contribute-all / payload v2 work that landed on main as 20a0c14. No code changes.

• CONTRIBUTING.md — adds a "Sharing fixes back upstream" subsection that splits the two paths a fix can travel (manual PR vs in-app one-tap), names the risky-word denylist verbatim so contributors know what gets auto-rejected, and explains the disabled-by-default policy for community custom buttons.
• SECURITY.md — adds the contribution path to the list of areas of interest, mentions Teach Mode alongside discovery for the "only proposes" guarantee, and notes the device-side payload contents (no viewing data leaves the device).

Test plan

• Both files render correctly in GitHub's markdown preview
• No broken internal links (risky-word regex and policy match what's deployed in the edge function)
• CONTRIBUTING reflects current UI: Settings → Add an app, per-card Contribute, and Apps-header Contribute all