chore(community): improve open-source readiness

[Dhi13man]

Why

The repository's community profile is 71%, has no Code of Conduct or pull request template, and
does not provide a private vulnerability-reporting policy. Its README also links to a nonexistent
license path, calls the GPL-3.0 license LGPL, and shows the wrong Maven group ID. The current CI
action pins emit Node 20 deprecation warnings, and there is no version-update configuration or
published OpenSSF Scorecard result.

Changes

• Add Contributor Covenant 3.0, a concise security policy, and focused pull request and issue
  templates.
• Add grouped weekly Dependabot updates for Maven and GitHub Actions.
• Add a least-privilege OpenSSF Scorecard workflow with every action pinned to a verified commit.
• Update checkout and setup-java to their current Node 24-based releases.
• Add the OpenSSF badge and correct the license path, license name, and Maven coordinates.
• Replace irrelevant browser/mobile issue prompts with Java, Spring Boot, and build-tool context.
• Update contribution commands for Java 17 and the exact Maven verification gate.
• Remove the dead Medium badge and repair Markdown formatting without changing product claims.

Test plan

• mvn --batch-mode --no-transfer-progress -Dgpg.skip=true clean verify: 25 tests passed and
  the JAR, sources, and Javadocs built.
• actionlint: both workflows passed.
• Parsed every .github/**/*.yml file with a YAML parser.
• markdownlint-cli2: README, community files, and templates passed with zero errors.
• markdown-link-check: README and contributing guide passed with zero dead links.
• gitleaks detect --no-git --source .: no secrets found.
• git diff --check: no whitespace errors.
• De-bloat scan: no register hits.
• Exact-head GitHub Actions, CodeQL, and GitGuardian checks pass.
• The first default-branch Scorecard run publishes a valid result and badge.
• GitHub recognizes the new community health files after merge.

Trade-offs

The Contributor Covenant and security policy add process, not runtime behavior. Dependabot may open
grouped maintenance pull requests each week, capped at five Maven pull requests; this is intentional
to prevent the unmanaged backlog that caused the security migration. Scorecard findings will be
visible in code scanning, but they are evidence to triage rather than automatic proof that source
code is vulnerable. No production or test source changed.

How to review

1. Review .github/workflows/scorecard.yml and .github/dependabot.yml for least privilege,
   immutable action pins, schedule, and bounded update grouping.
2. Review SECURITY.md, CODE_OF_CONDUCT.md, and .github/PULL_REQUEST_TEMPLATE.md for practical
   reporting and contribution guidance without promises a volunteer maintainer cannot keep.
3. Review README.md and CONTRIBUTING.md for the corrected GPL-3.0 path, Maven coordinates,
   Java 17 baseline, and link integrity.
4. Review .github/ISSUE_TEMPLATE/ to confirm bug reports collect library-specific reproduction
   evidence and route security reports privately.