add a page about contributing in general

I think it'd also be good to have a document explaining how to set up
and work with the development environment for contributing code, but I
think that should probably live on a separate, dedicated page.

book/SUMMARY.md

@@ -2,3 +2,4 @@
 
 * [Introduction](./introduction.md)
 * [Code of conduct](./code-of-conduct.md)
+* [Contributing](./contributing.md)

book/contributing.md

@@ -0,0 +1,47 @@
+# Contributing
+
+## On Matrix
+
+Currently, the Matrix room at [#grapevine:computer.surgery][room] serves
+multiple purposes:
+
+* General discussion about the project, such as answering questions about it
+* Reporting issues with Grapevine, if getting GitLab access is too much trouble
+  for you
+* Providing support to users running Grapevine
+* Discussing the development of Grapevine
+
+If you'd like to engage in or observe any of those things, please join!
+
+[room]: https://matrix.to/#/#grapevine:computer.surgery
+
+## On GitLab
+
+Instructions for getting GitLab access can be found on the [sign-in][sign-in]
+page.
+
+GitLab access is primarily useful if you'd like to open issues, engage in
+discussions on issues or merge requests, or submit your own merge requests.
+
+Note that if the sign-up process is too much trouble and you'd just
+like to report an issue, feel free to report it in the Matrix room at
+[#grapevine:computer.surgery][room]; someone with GitLab access can open an
+issue on your behalf.
+
+[sign-in]: https://gitlab.computer.surgery/users/sign_in
+
+## Information about a vulnerability
+
+If you find a security vulnerability in Grapevine, please privately report it to
+the Grapevine maintainers in one of the following ways:
+
+* Open a GitLab issue that's marked as confidential
+* Create a private, invite-only, E2EE Matrix room and invite the following
+  users:
+  * `@benjamin:computer.surgery`
+  * `@charles:computer.surgery`
+  * `@xiretza:xiretza.xyz`
+
+If the maintainers determine that the vulnerability is shared with Conduit or
+other forks, we'll work with their teams to ensure that all affected projects
+can release a fix at the same time.