chore: add community files and PSGallery publish workflow

- Add CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md
- Add .gitattributes for line ending normalization
- Add GitHub issue templates (bug report, feature request)
- Add pull request template
- Add publish.yml workflow for PSGallery publication on tag push

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

SECURITY.md

@@ -0,0 +1,45 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---|---|
+| 0.1.x (current) | Yes |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in PSProxmoxVE, please report it responsibly.
+
+**Do not open a public issue for security vulnerabilities.**
+
+Instead, please email the maintainer directly or use [GitHub's private vulnerability reporting](https://github.com/goodolclint/PSProxmoxVE/security/advisories/new).
+
+### What to include
+
+- A description of the vulnerability
+- Steps to reproduce the issue
+- The potential impact
+- Any suggested fixes (optional)
+
+### Response timeline
+
+- **Acknowledgment**: Within 48 hours of receipt
+- **Initial assessment**: Within 1 week
+- **Fix release**: As soon as practical, depending on severity
+
+## Security Considerations
+
+### Credential Handling
+
+- PSProxmoxVE accepts credentials via `PSCredential` objects and API tokens.
+- Credentials are not written to disk or included in verbose/debug output.
+- Ticket-based sessions expire after 2 hours. The module detects and reports expiry.
+
+### TLS/HTTPS
+
+- All API communication uses HTTPS.
+- The `-SkipCertificateCheck` parameter disables TLS certificate validation. Use only in trusted networks or test environments.
+
+### Dependencies
+
+All NuGet dependencies are pinned to specific versions. We monitor for known vulnerabilities and update promptly.