Add contribution & vuln reporting guidelines

[survived]

Clippy errors seem to be false-positive — when I remove references as suggested, it doesn't compile anymore

UPD: it was already reported here