ci+docs: CONTRIBUTING.md + clang-tidy workflow + .clang-tidy config

[ronaldtse]

Summary

Closes #1189 (Code of Conduct + community guidelines) and #2317 (Investigate GitHub Action static analysis tool).

CONTRIBUTING.md

The CoC already exists at docs/code-of-conduct.adoc (linked from README), but there was no CONTRIBUTING.md. This PR adds one covering the practical bits contributors actually need:

• Build & test commands for both Botan and OpenSSL backends.
• Code style (clang-format v11, .clang-format is the source of truth).
• Commit message conventions (50/72, imperative mood, no AI-attribution trailers).
• PR checklist (rebased, clang-format clean, tests pass on at least one backend, regression test for behaviour changes).
• The crypto-path test discipline (assert output is encrypted, contains no plaintext key material).
• How to add a new FFI function and a new CMake option (so future contributors don't have to reverse-engineer the patterns).

clang-tidy CI workflow + .clang-tidy config

• Workflow .github/workflows/clang-tidy.yml: runs on push + PR, on clang-18 with both Botan and OpenSSL backends. Builds with CMAKE_CXX_CLANG_TIDY so clang-tidy runs per translation unit. Captures findings to the GitHub Step Summary (top-10 check categories) and uploads the full log as a 14-day artifact.
• Config .clang-tidy: starts permissive — only a curated set of high-confidence checks (bugprone, cert subset, performance, modernize, readability). WarningsAsErrors is not enabled initially; the existing codebase has too many findings to flip the gate on all at once. The plan is to tighten incrementally per TODO.rnp-roadmap/20-static-analysis.md.
• The workflow deliberately does not fail the build today — it surfaces findings for triage. Tightening to gate-on-fail is a follow-up once the existing findings are addressed.

Test plan

• CONTRIBUTING.md renders correctly on GitHub.
• clang-tidy workflow runs on a sample change and uploads the log artifact.
• The curated check set produces a tractable volume of findings (not 10000+).

Out of scope (follow-up)

• Tightening .clang-tidy check set after triaging initial findings.
• Flipping WarningsAsErrors: '*' once clean.
• The same pattern applied to Coverity (project already has a coverity.yml daily scan; could add PR-time gating once a baseline is established).
• Adding good first issue labels to small starter bugs (mentioned in TODO.rnp-roadmap/16).

Closes #1189.
Closes #2317.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.36%. Comparing base (953d2e0) to head (eeecc7f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2418      +/-   ##
==========================================
- Coverage   85.36%   85.36%   -0.01%     
==========================================
  Files         126      126              
  Lines       22861    22866       +5     
==========================================
+ Hits        19516    19520       +4     
- Misses       3345     3346       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.