chore(scaffold): community health files

[rennf93]

Delivers issue: none (repo chore, carries the no-issue label)

Description

Process scaffold roll-out to the PHP family, modeled on the Go family and the fastapi-guard baseline. Additive only: no existing workflow is touched, no composer requirement or version changes.

Added

• SECURITY.md: supported versions 3.1.x / 3.0.x, reporting via GitHub security advisories.
• CONTRIBUTING.md: php ^8.2, composer install, composer test / composer lint, PR rules (issue or no-issue label, lowercase conventional commits, no attribution trailers).
• CODE_OF_CONDUCT.md: verbatim from fastapi-guard.
• .github/FUNDING.yml: github: rennf93, paypal custom link, tidelift commented out.
• .github/PULL_REQUEST_TEMPLATE.md: verbatim from fastapi-guard.
• .github/ISSUE_TEMPLATE/{bug,feature,docs,config}.yml: adapted (product name, docs URL https://rennf93.github.io/guard-agent-php/, php config render).

Skipped

• CodeQL (code-ql.yml): drafted as directed, but the first run proved it cannot pass. GitHub CodeQL no longer supports PHP: github/codeql-action/init@2892aa5 (v4.38.2, the Go family pin) fails in Initialize CodeQL with Did not recognize the following languages: php. The file was dropped from this PR to keep CI green. Added instead: .github/workflows/semgrep.yml (the PHP-capable substitute), running the pinned semgrep/semgrep:1.177.0 container with the p/security-audit and p/secrets rulesets over src/ (--error), path-filtered push/PR triggers plus a weekly Monday cron; SEMGREP_SEND_METRICS off.
• CHANGELOG.md: already exists.
• Advanced-app live smoke and phpstan static analysis: adapter-only rollout scope.

Verification

• every touched workflow yaml-validated (pyyaml).