docs: Add the community health files and correct a stale CI note

[sdebasek]

1. Issue forms

bug_report asks for the diagnostics dump, model, firmware and configuration mode up front. CONTRIBUTING already calls a diagnostics dump as valuable as a patch, but nothing prompted anyone for one.

device_report is deliberately separate. The integration detects capabilities at runtime and has only ever been verified on one product line, so a report from other hardware is worth asking for on its own terms, including when everything worked.

config.yml points setup and troubleshooting questions at the docs, and vulnerabilities at private reporting rather than a public issue.

2. SECURITY.md

Documents the unauthenticated callback endpoint rather than waiting to be asked. It looks alarming and is deliberate: the device cannot hold a bearer token, so the URL carries 128 bits from secrets.token_hex(16), compared with hmac.compare_digest. Also covers why callback URLs are secrets, why device traffic is plain HTTP, and the device's own access point.

Private vulnerability reporting is now enabled on the repo, so the link works.

3. CODE_OF_CONDUCT.md

Contributor Covenant 2.1. Enforcement contact is the maintainer via GitHub rather than an email address, to keep one out of a public file.

4. CONTRIBUTING correction

It claimed branch protection required only hassfest, HACS and tests, and that a red ruff job still left the merge button live. ruff has been required for some time. The minimum HA paragraph is unchanged and still accurate.

Testing

All four YAML files parse. No code touched, so the suite is unaffected.