Add CONTRIBUTING/CODE_OF_CONDUCT/SECURITY + first tag

[next-nf]

Add the three governance files (consistent with the license review outcome); cut the first semver tag. Depends on the license-review spike.
Accept: three files present; tag pushed.

Epic: next-nf/next-nf#16