Add a DCO sign-off check for pull requests

[chrisholloway5]

What

Require Signed-off-by: trailers on pull-request commits and check them in CI.

Why

The project is AGPL-3.0-or-later and CONTRIBUTING.md says contributions are licensed the same way, but nothing records that the contributor agreed - there is no CLA and no DCO. The Developer Certificate of Origin (https://developercertificate.org/) is the lightweight answer, and it is the OpenSSF badge's dco criterion. No commit in the repository currently carries a sign-off, so this applies to new contributions only.

How

1. Add a DCO job to .github/workflows/style.yml (or its own workflow) on pull_request, checking every commit in the PR for a Signed-off-by: line matching the author. Pin the action by commit SHA like every other action in this repository.
2. Add a short Sign-off paragraph to .github/CONTRIBUTING.md: what git commit -s does, the one-line meaning of the DCO, and a link to the text.
3. Keep it to pull requests. The maintainer's direct history is not retrofitted, and the check must not block Dependabot (exempt its bot account, or let it sign off - it can).

Done when

A PR without sign-offs shows a red check naming the commit, a PR with them is green, and the contributing guide explains the one command.