docs: deduplicate security content and align with onboarding guidelines

[nexus49]

Summary

This PR removes duplicated security content from the project guidelines and replaces it with cross-references to the NeoNephos Security Guidelines, establishing a single source of truth for security requirements. It also aligns priority levels and terminology between the project guidelines and onboarding guidelines.

Depends on #7 (security guidelines) being merged first — the cross-references target sections introduced by that PR.

Changes and reasoning

Security deduplication (project-guidelines.md)

• §6 Security Disclosure: Replaced four inline MUST/SHOULD bullets (SECURITY.md, disclosure contacts, private reporting, alternative channels) with a single reference to the security guidelines. These requirements are fully covered by Security Guidelines §5 and §6.
• §6 Dependency Management: Replaced the MAY generate SBOMs bullet with a reference to Security Guidelines §8 (Supply Chain Security), which defines SBOM, dependency scanning, signing, and provenance requirements.
• §11 Security: Expanded the section description to clarify what the security guidelines cover (vulnerability disclosure, supply chain, transparency). Removed the sentence splitting scope between §15.3 and the security guidelines — all security content should live in one place.
• §15.1 Artifact Hosting: Updated the artifact signing reference to point directly to Security Guidelines §8 instead of §11.
• §15.3 Security and Compliance: Collapsed the entire section (mandatory + supplemental compliance: 2FA, GitHub Actions, runners, data retention, maintainer permissions, CI hardening) into a single reference to the security guidelines. This content should be absorbed into the security guidelines document. Also fixed the "must they must" typo and inconsistent punctuation while the section was being edited.
• TOC: Removed 15.3.1 and 15.3.2 sub-entries that no longer exist.

Onboarding alignment (both documents)

• §4 Technical Charters: Upgraded from SHOULD to MUST to match the onboarding requirement that projects must publish their charter.
• §5 Security Officer: Added a new requirement (MUST designate a Security Officer) that was present in onboarding but missing from project guidelines.
• §6 Data Collection and Privacy: Added three new requirements from onboarding that had no equivalent in project guidelines: data collection documentation with opt-out, PII exclusion from telemetry, and Data Processing Notice.
• onboarding-guidelines.md: Aligned "Linux Foundation Code of Conduct" → "NeoNephos Code of Conduct" (with link) and "LF-approved licenses" → "licenses approved through their Project Charter" to match the project guidelines terminology.

Editorial fixes

• Fixed "goverened" typo in §1.
• Fixed trailing semicolon in §8 Related sections.

[jmertic]

This is problematic, as each project has definied in it's techincal charter to use the LF Europe CoC unless the project has it's own pre-approved ( see 4c).

[fmui]

See PR #3.

[nexus49]

ok is it NeoNephos Code of Conduct or LF Europe CoC ?

[jmertic]

Let's never say people can convert or copy the charter - we can provide the link to the source doc hosted by the LF.

[nexus49]

we can also change the wording, I took the wording from the onboardind guide here:
https://github.com/neonephos/guidelines-development/blob/main/onboarding/onboarding-guidelines.md?plain=1#L17

I'll adjust to make it a link to the source doc on both documents.

[jmertic]

We should bring in the LF License Scanning program to help here. I can have that lead come to a TAC meeting to discuss.