chore: add CODEOWNERS, dependabot config, and contributor docs

[jamesnrokt]

Summary

Brings this repo in line with the other mParticle SDK repos, which all carry these governance files. No src/ changes.

• .github/CODEOWNERS — * @mParticle/sdk-team, matching apple/android/web. Without it PRs here request no reviewers at all, which is how feat: add Samsung TV Tizen ID support #31 went unnoticed.
• .github/dependabot.yml — weekly gradle and github-actions updates. Alerts were already on, but with no config there were no update PRs. commit-message.prefix: chore keeps generated titles passing the semantic-title check.
• SECURITY.md — points at Rokt's vulnerability disclosure form. There is no org-level SECURITY.md fallback, so this public repo previously had no disclosure path other than a public issue.
• CONTRIBUTING.md — build/test commands plus the branch-name and PR-title rules CI already enforces but that were documented nowhere.
• AGENTS.md + CLAUDE.md — agent guidance, with CLAUDE.md importing AGENTS.md as in apple/maui.

Two things the docs call out that aren't obvious from the repo: changelog entries must be added by hand under ## [Unreleased] (release automation renames that heading but never writes entries), and publishToMavenLocal needs -PVERSION=<x>-SNAPSHOT because signAllPublications() makes the bare command fail without the release key.

Testing Plan

• Docs and config only; src/ untouched, so unit tests are unaffected.
• dependabot.yml validated as well-formed Dependabot v2 YAML. labels: deliberately omitted — a custom label that doesn't exist in the repo is ignored and suppresses the defaults.
• CODEOWNERS validated against GitHub's codeowners/errors endpoint (no errors); @mParticle/sdk-team has admin here, so it resolves as a valid owner.
• After merge: confirm a new PR auto-requests review from the team, and that the first Dependabot PR passes the required checks.

[cursor]

PR Summary

Low Risk
Documentation and GitHub automation config only; no library code, APIs, or dependency versions change in this PR.

Overview
Aligns the Java Server Events SDK repo with other mParticle SDKs by adding governance and contributor-facing docs only—no src/ or runtime changes.

.github/CODEOWNERS assigns @mParticle/sdk-team on all paths so new PRs auto-request review (review is still not a merge gate). .github/dependabot.yml enables weekly Gradle and GitHub Actions update PRs with chore-prefixed commits so titles pass the existing semantic-title check; custom Dependabot labels are intentionally omitted to avoid silent label suppression.

SECURITY.md documents vulnerability reporting via Rokt’s disclosure form instead of public issues. CONTRIBUTING.md records JDK/build/test commands, local publishToMavenLocal -PVERSION=…-SNAPSHOT, PR/branch conventions, and hand-maintained CHANGELOG.md entries under ## [Unreleased]. AGENTS.md (and CLAUDE.md pointing at it) capture maintainer/agent traps: signing, model editing, release workflow quirks, and Dependabot/CI behavior.

^{Reviewed by Cursor Bugbot for commit 95f7e32. Bugbot is set up for automated code reviews on this repo. Configure here.}