doc: Let the org-wide SECURITY.md and CODE_OF_CONDUCT.md apply

A repository's own copy overrides the default from the .github repo, so
the security policy rewritten there on 2026-08-30 - a real reporting
channel, stated response times, a scope - never reached this repository.
Three copies of a policy is how they drift apart, and they had.

The Code of Conduct link in CONTRIBUTING.md now points at the org copy
by URL; a relative link would break here, and was already broken in
cuos-release, which never had the file.

Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz

CODE_OF_CONDUCT.md

@@ -2,7 +2,7 @@
 
 We welcome contributions from the community!
 
-- All contributors are expected to follow our [Code of Conduct](CODE_OF_CONDUCT.md).
+- All contributors are expected to follow our [Code of Conduct](https://github.com/cuos-dev/.github/blob/main/CODE_OF_CONDUCT.md).
 - All contributions must comply with the [Developer Certificate of Origin (DCO)](DCO.txt). This means adding a Signed-off-by line to your commits.
 - Contributions are accepted under the project's license, **Apache-2.0**, as stated in each source file's `SPDX-License-Identifier` line. You keep the copyright to your contribution.
 
@@ -61,6 +61,6 @@ We value respectful, inclusive, and constructive collaboration. Please:
   * Be kind and respectful in all interactions.
   * Use clear and concise language.
   * Provide helpful feedback and be open to receiving it.
-  * Follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+  * Follow the [Code of Conduct](https://github.com/cuos-dev/.github/blob/main/CODE_OF_CONDUCT.md).
 
 Thank you for helping make CuOS better!