add CONTRIBUTING.md and SECURITY.md

[skip ci]

Author: mtf90

CONTRIBUTING.md

@@ -0,0 +1,31 @@
+# How to contribute to LearnLib
+
+
+### **Did you find a bug?**
+
+* **If the bug is a security vulnerability** do not open up a GitHub issue but instead refer to our [security policy](https://github.com/LearnLib/learnlib/blob/develop/SECURITY.md).
+
+* **Ensure the bug was not already reported** by searching on GitHub under [Issues](https://github.com/LearnLib/learnlib/issues).
+
+* If you're unable to find an open issue addressing the problem, [open a new one](https://github.com/LearnLib/learnlib/issues/new?template=bug_report.md). Please provide as much relevant information as possible including a precise title.
+
+
+### **Did you write a patch that fixes a bug?**
+
+* Open a new GitHub pull request with the patch.
+
+* Ensure the PR description clearly describes the problem and solution. Include the relevant issue number if applicable.
+
+* Before submitting, you can test locally whether the integration tests will (likely) pass. Simply enable the same Maven profiles as our [CI pipelines](https://github.com/LearnLib/learnlib/blob/develop/.github/workflows/ci.yml).
+
+
+### **Do you intend to add a new feature or change an existing one?**
+
+* Suggest your change in the [discussions](https://github.com/LearnLib/learnlib/discussions/categories/ideas) and start writing code.
+
+* Do not open an issue on GitHub until you have collected positive feedback about the change. GitHub issues are primarily intended for bug reports and confirmed feature requests.
+
+
+### **Do you have questions about the source code?**
+
+* Ask any questions about how to use LearnLib in the [discussions](https://github.com/LearnLib/learnlib/discussions/categories/q-a).

SECURITY.md

@@ -0,0 +1,5 @@
+# Reporting Security Issues
+
+To report a security issue, please use the GitHub ["Security Advisory"](https://github.com/learnlib/learnlib/security/advisories/new) function.
+
+The LearnLib team will send a response indicating the next steps in handling your report. After the initial reply to your report, we will keep you informed of the progress towards a fix and may ask for additional information or guidance.