P2: Add bug-routing table to CONTRIBUTING.md (engine vs wrapper)

[rahuldass19]

Summary

The action repo has a CONTRIBUTING.md file, but it does not clearly route bugs between the action repo (wrapper) and the core repo (engine). As a GitHub Technology Partner action, contributors will arrive at this repo — they need to know where to file what.

Why this matters

This action is a thin wrapper over the core QWED image. Its job is to faithfully invoke the verification engine, not to verify. Contributors need a clear routing rule so engine bugs don't get filed here and wrapper bugs don't get filed in the core repo.

Fix

Add a clear routing section to CONTRIBUTING.md:

Bug type	Where to file
Engine bugs (logic bypass, injection, RCE in scanned content, verification correctness)	QWED-AI/qwed-verification
Wrapper bugs (input/env handling, output leakage, SARIF malformation, action.yml schema)	This repo (QWED-AI/qwed-verification-action)

Also document the wrapper philosophy: the action repo's job is faithful invocation of the engine, not verification itself. The thinner the wrapper, the better.

Acceptance Criteria

• CONTRIBUTING.md has a clear bug-routing table (engine vs wrapper)
• The wrapper philosophy is stated (faithful invocation, not verification)
• Links to the core repo's CONTRIBUTING/SECURITY are included