add CONTRIBUTING.md, update contributing guide in docs

[leondz]

Good point. The DCO process provides protection and health for our project but doesn't necessarily protect others, as this suggestion would.