add contributing guidelines and related docs (#1134)

Part of [CMP-81](https://youtrack.jetbrains.com/issue/CMP-81) Check
Compose repositories for following JetBrains rules
and [CMP-82](https://youtrack.jetbrains.com/issue/CMP-82) Make a
contribution guide for Compose repositories

CODE_OF_CONDUCT.md

+## Code of Conduct
+
+This project and the corresponding community are governed by the [JetBrains Open Source and Community Code of Conduct](https://github.com/jetbrains#code-of-conduct).
+Please make sure you read it.
+

CONTRIBUTING.md

+# What this repository is
+
+This repository contains sources of Kotlin Multiplatform wrappers for Skia which are used in [Compose Multiplatform](https://github.com/JetBrains/compose-multiplatform).
+
+# What this repository is not
+
+We currently do not consider this as a separate product and have no plans to releasing it separately.
+Thus, only contributions relevant for Compose Multiplatform can be accepted.
+
+# Contributing
+
+We love contributions!
+If you want to find some issues to start off with,
+try [this query](https://youtrack.jetbrains.com/issues/SKIKO?q=tag:%20%7BUp%20For%20Grabs%7D%20%23Unresolved) which should find all open Skiko issues that are marked as "up-for-grabs".
+
+If you'd like to fix a bug or add a feature, [create a YouTrack issue](https://youtrack.jetbrains.com/newIssue?project=SKIKO) for it first.
+You'll then be able to discuss the proposed change with maintainers.
+It would help to avoid situations when the change conflicts with some other feature or help discover potential edge cases.
+
+Currently only committers can assign issues to themselves so just add a comment if you're starting work on it.
+
+Make sure to follow the [development guide](DEVELOPMENT.md) for local set up.
+
+## Submitting patches
+
+The best way to submit a patch is to [fork the project on GitHub](https://help.github.com/articles/fork-a-repo/) and then send us a
+[pull request](https://help.github.com/articles/creating-a-pull-request/) to the `master` branch via [GitHub](https://github.com).
+
+If you create your own fork, it might help to enable rebase by default
+when you pull by executing
+``` bash
+git config --global pull.rebase true
+```
+This will avoid your local repo having too many merge commits
+which will help keep your pull request simple and easy to apply.
+
+## Rules for commit messages
+
+Most of these rules are originated from the [How to Write a Git Commit Message](https://chris.beams.io/posts/git-commit/)
+article, and it's highly recommended to read it.
+
+### Rules on commit messages' content
+
+1. Use the body to explain what and why vs. how
+    * Please make an extra effort to explain why changes are needed for every non-trivial modification.
+2. Significant commits must mention relevant [YouTrack](https://youtrack.jetbrains.com/issues/SKIKO) issues in their messages
+3. Commit changes together with the corresponding tests, unless the resulting commit becomes too unwieldy to grasp
+4. Keep the subject (first line of the commit message) clean and readable. All additional information and directives for external tools
+   should be moved to the message body.
+
+### Rules on commit messages' style/formatting
+
+1. Separate subject from body with a blank line
+2. Capitalize the subject line
+3. Do not end the subject line with a period
+4. Use the imperative mood in the subject line
+5. Limit the commit messages lines to 72 characters
+    * Use “Commit Message Inspections” in IntelliJ IDE *Settings -> Version Control -> Commit*
+    * vim: ```autocmd FileType gitcommit setlocal textwidth=72```
+
+## Checklist
+
+Before submitting the pull request, make sure that you can say "YES" to each point in this short checklist:
+
+- You provided the link to the related issue(s) from YouTrack
+- You made a reasonable amount of changes related only to the provided issues
+- You can explain changes made in the pull request
+- You ran the build locally and verified new functionality
+- You ran related tests locally and they passed
+- You do not have merge commits in the pull request

SECURITY.md

+## Security
+
+We do our best to make sure our products are free of security vulnerabilities. To reduce the risk of introducing a vulnerability,
+you can follow these best practices: 
+
+* Always use the latest release. For security purposes, we sign our releases published on [Maven Central](https://central.sonatype.com/search?q=g:org.jetbrains.skiko) 
+with these PGP keys:
+
+  * Key ID: **compose@jetbrains.com**
+  * Fingerprint: **2072 3A63 99BC 0601 5428 3B37 CFAE 163B 64AC 9189**
+  * Key type: **ed25519**
+
+* Use the latest versions of your application's dependencies. If you need to use a specific version of a dependency, 
+periodically check if any new security vulnerabilities have been discovered. You can follow 
+[the guidelines from GitHub](https://docs.github.com/en/code-security) 
+or browse known vulnerabilities in the [CVE base](https://www.cve.org/CVERecord/).
+
+We are very eager and grateful to hear about any security issues you find.
+To report vulnerabilities that you discover in Skiko,
+please post a message directly to our [issue tracker](https://youtrack.jetbrains.com/newIssue?project=SKIKO&c=Type%20Security%20Problem) or send us an [email](mailto:security@jetbrains.org). 
+
+For more information on how our responsible disclosure process works, please check the [JetBrains Coordinated Disclosure Policy](https://www.jetbrains.com/legal/docs/terms/coordinated-disclosure/).
+