Security policy, sponsor button, PR template, Dependabot for actions

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github: [LogicalError]
+patreon: logicalerror

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/pull_request_template.md

@@ -0,0 +1,8 @@
+**What this changes and why**
+
+**Fixes** #
+
+**How it was tested** (scene, steps, Unity version)
+
+- [ ] Compiles without warnings, in the editor and in a player build
+- [ ] Tests added or updated, and the EditMode tests pass

.github/workflows/checks.yml

@@ -1,5 +1,8 @@
 name: Checks
 
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:

CONTRIBUTING.md

@@ -47,6 +47,8 @@ almost always belongs in the CSG, not in a special case in the generator.
 * New features should work for any level someone builds by hand, not only for one kind of content, and be reachable
   from the editor's UI.
 
+Pull requests are squash-merged into a single commit, which keeps you as its author.
+
 ## Tests
 
 The tests are in `Core/Tests`, `Components/Tests` and `Editor/Tests`. With Chisel embedded in your project's

SECURITY.md

@@ -0,0 +1,5 @@
+# Security
+
+Please report security problems privately, through **Report a vulnerability** on the [Security tab](https://github.com/RadicalCSG/com.chisel/security) of this repository, rather than in a public issue.
+
+Fixes go into the newest version.