CONTRIBUTING: note DCO sign-off requirement alongside GPG signing

All commits require both a GPG signature and a DCO sign-off
(git commit --signoff), certifying the contributor wrote the code
and has the right to submit it under the project licence.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Author: tlaurion

CONTRIBUTING.md

@@ -56,9 +56,12 @@ If you're unsure about what kind of issue you're looking at or whether it's an a
 - Link to related issues or discussions.
 - Provide a clear description of the changes and their purpose.
 - Be responsive to feedback and prepared to make adjustments.
-- **Important**: All commits to linuxboot/heads (*not heads-wiki!*) must be signed. 
+- **Important**: All commits to linuxboot/heads (*not heads-wiki!*) must be signed.
   - For instructions, see: [Signing commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
   - If you won't GPG-sign your commits (GitHub signature doesn't count), they will get signed by a maintainer after a successful review, but it's strongly preferred you do it yourself.
+- All commits must also carry a **DCO sign-off** (`git commit --signoff`),
+  certifying that you wrote the code and have the right to submit it
+  under the project licence.
 
 ## GitHub Repositories