docs: clarify collaborator-only pull request policy (#3948)

## Summary

Make the contribution guidance match the repository's collaborator-only
pull request policy. The README links to CONTRIBUTING.md, both
explicitly exclude PRs from non-collaborators, and community feedback
goes through issues. Existing development instructions remain available
to collaborators, and security reports continue through the private
disclosure process.

Remove the conflicting invitation to external PRs from the pull request
template.

Use absolute README links to the policy and security guide so
package-page readers can follow them.

## Test plan

- `git diff --check` and targeted policy/link checks pass.
- Reviewed the complete diff and contributor, collaborator, and private
security-reporting paths.

Documentation only; no SDK runtime, repository settings, or generated
source changes.

<!-- codex-thread: 01a0cc13-4a7c-7883-aa1d-cc4373a5f7af -->