CONTRIBUTING and SECURITY do not mention the artifact/code licensing split

[kinlane]

The org now has a real licensing policy — artifacts CC BY-NC-SA 4.0, code Apache-2.0, with repos carrying both shipping LICENSE and LICENSE-CODE. It is stated in every repo README and in the org profile.

It is not stated in the shared contribution docs, which is where a contributor looks before opening a PR:

• CONTRIBUTING.md
• SECURITY.md

What CONTRIBUTING should say

• Which license a contribution falls under, and that it depends on what you are contributing — a schema and a validator in the same repo are licensed differently.
• That contributing implies agreement to those terms.
• The artifact/code boundary, concretely: LICENSE covers schemas, rulesets, fixtures, examples, API descriptions; LICENSE-CODE covers validators, harnesses, packaging.
• That the spectral and spotlight-tools builds keep upstream's Apache-2.0 and are not relicensed.

Worth deciding at the same time

CC BY-NC-SA is share-alike. A contribution to an artifact repo, and any derivative of it, carries that obligation forward. That is a heavier commitment than Apache-2.0 asks of a contributor, and it should be visible before someone opens a PR rather than discovered afterwards.

Also worth checking the issue and PR templates in .github/ISSUE_TEMPLATE/ and PULL_REQUEST_TEMPLATE.md for anything that contradicts the new policy.