docs: add issue templates for the issues-only contribution model

[cliffhall]

Split out of #1820 (phase 6), which is otherwise complete.

Why this matters more now than it used to

External pull requests are off — the repo moved to Collaborators-only in phase 6, and CONTRIBUTORS.md documents the issues-only policy. So issues are now the single intake channel for everyone outside the org.

GitHub gives a would-be contributor no explanation when the "Create pull request" button is missing. CONTRIBUTORS.md covers that, but only if they find it. Templates put the policy in front of them at the exact moment they are trying to contribute.

There are currently no templates at all — .github/ISSUE_TEMPLATE/ does not exist.

Suggested set

Template	Purpose
Bug report	Which client (web / cli / tui), Inspector version, Node version, MCP server + transport, repro steps. Most bug reports currently arrive missing the client and transport, which are the two facts that determine where to look.
Feature request	Problem before solution; note that maintainers implement, so a clear problem statement is more useful than a patch.
v1 security issue	Should redirect to the advisory process, not collect details in public. See SECURITY.md (restored in #1843).

Plus config.yml with:

• blank_issues_enabled: false — so everything lands in a template
• Contact links to CONTRIBUTORS.md (why no PRs), SECURITY.md (private reporting), and the docs site

Worth deciding while writing these

• Should the bug template ask v1 vs v2? v1 is deprecated and takes security fixes only, so a v1 bug report needs a different answer than a v2 one. Cheapest way to route that is a required dropdown.
• The MCP spec vs the Inspector. A recurring class of issue is actually about the protocol or the SDK, not this tool. A contact link to the spec repo would deflect some of it before it becomes triage work.

Related

• go-live 6/9: restrict PRs to collaborators; CONTRIBUTORS.md + SECURITY.md #1820 — phase 6, the contribution-model change these support
• Add CONTRIBUTORS.md: issues-only policy (share prompts, not PRs) #1517 — the CONTRIBUTORS.md policy
• docs: restore SECURITY.md, lost in the v2 tree swap #1843 — SECURITY.md restored, which the security template should point at