chore: get CryptOS-PKI ready for a CNCF Sandbox application #4

Summary

Get CryptOS-PKI ready to apply to the CNCF Sandbox, and then apply. This is org-wide: it touches every public CryptOS-PKI repo, not only the docs.

Acceptance criteria

Taken from the CNCF Sandbox requirements (github.com/cncf/sandbox). Re-check them when applying, since they change.

• Every repo is licensed Apache 2.0 before applying (CNCF doesn't accept "we'll convert after acceptance"). All dependencies follow the CNCF IP Policy or an existing blanket exception.
• A MAINTAINERS.md with a table of Name, GitHub ID and Company/Organization. CNCF won't accept a link to the contributors graph or "N/A".
• The project is a reusable project, not a reference architecture.
• A Sandbox Application is opened with the issue form in cncf/sandbox, and every section is filled in.
• After approval, the CNCF Contribution Agreement is signed.

Expected by reviewers and by the application form, to confirm against the form:

• Org-wide CODE_OF_CONDUCT.md (CNCF code of conduct), CONTRIBUTING.md, GOVERNANCE.md and SECURITY.md with a private way to report vulnerabilities.
• An OpenSSF Best Practices badge.
• A contribution sign-off policy (DCO or CLA).

Tasks

• Read the current Sandbox application form end to end and list every question and every file it links to.
• Confirm the license and NOTICE state of every public repo. lab and .github have no LICENSE file today.
• Run a dependency-license check against the CNCF IP Policy allowlist for cryptos, api, manager, web and helm.
• Add org defaults in this repo: CODE_OF_CONDUCT.md, CONTRIBUTING.md, GOVERNANCE.md, SECURITY.md (with private vulnerability reporting switched on in each repo).
• Add MAINTAINERS.md in the required table format.
• Decide the contribution sign-off policy. The DCO needs Signed-off-by: lines, which the current commit rules forbid, so this needs an owner decision.
• Apply for the OpenSSF Best Practices badge and close the gaps it finds.
• Write the application: the problem CryptOS solves, how it relates to cloud native (Kubernetes and cert-manager issuing, workload and cluster PKI), comparisons with similar projects, and the roadmap.
• Have the prerequisites in place first: accurate docs with no stubs, a first tagged release, and the open security bugs fixed (fix(attest): keep Attest signatures apart from certificate signing cryptos-node#278).
• Submit the application.

Notes

Maintainer diversity isn't required, but the TOC weighs it, and GitHub org membership doesn't count towards it. Today there's one maintainer. The TOC votes roughly every two months, 7 to 10 applications at a time, first in first out.