docs: align issue templates and contributing guide with label taxonomy

[JohnsonLyu]

Closes #437

Summary

• Stop issue templates from applying bug / enhancement; use issue types plus needs triage
• Document the label taxonomy in CONTRIBUTING.md
• Stop upstream-spec-check.yml from applying the maintenance label

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Framework Changes Checklist

N/A

Control/TOML Changes Checklist

N/A

Testing

• Tests pass locally (uv run pytest tests/ -v)
• Added tests for new functionality (if applicable)
• Linting passes (uv run ruff check .)

Docs/templates only; no code tests needed.

AI assistance

• No AI assistance was used
• AI assistance was used

Cursor: reviewed remaining gaps and helped with PR wording.

Additional Notes

This PR covers the in-repo parts of #437. Creating, renaming, and deleting GitHub labels still needs a maintainer after merge:

• Create: module-core, module-baseline, module-amber, needs triage, interface-mcp
• Rename: invalid → closed-invalid, wontfix → closed-wontfix, cli → interface-cli, question → need info
• Delete: bug, enhancement, maintenance, ux, quality

[mlieberman85]

The type: frontmatter works -- the org has Bug and Feature enabled. Taking #437's taxonomy as settled, this is close. Four things to add.

1. The labels don't exist yet, and unknown labels get dropped silently. Dependabot PR #440 has zero labels right now, because .github/dependabot.yml asks for dependencies and ci and neither exists. needs triage will go the same way: new issues would land with no label, where today they get bug or enhancement. The label changes in #437 need to land before or with this PR.

2. Do the label changes as code. Nothing in the repo creates labels today. A .github/labels.yml manifest plus a sync workflow makes the taxonomy reviewable in a PR and keeps it from drifting away from these templates. Pin the action by SHA like the other workflows here.

3. needs triage won't reach every issue. .github/ISSUE_TEMPLATE/config.yml sets blank_issues_enabled: true, so issues opened without a template skip both files changed here. Set it to false, or add a labeler workflow on issues: opened.

4. dependencies, python and ci are in use but absent from the taxonomy. They come from dependabot.yml. Either add them to #437's list or point dependabot at labels that exist.

Closes #437 also covers the GitHub-side label work, which isn't in this diff. If that lands separately, use Refs #437.

[mlieberman85]

#437 notes that future modules each get a module-<name> label. State the convention here -- gittuf and reproducibility ship today and csl arrives in #449, so the next plugin author needs the rule, not just three examples.

Suggested change

	- `module-core` — darnit core
	- `module-baseline` — OpenSSF Baseline module
	- `module-amber` — Amber module
	- `interface-cli` — command-line interface
	- `interface-mcp` — MCP interface
	- `module-core` — darnit core
	- `module-baseline` — OpenSSF Baseline module
	- `module-amber` — Amber module
	- `interface-cli` — command-line interface
	- `interface-mcp` — MCP interface
	Each module gets its own `module-<name>` label as it lands.

[JohnsonLyu]

Should we delete bug and enhancement now, or keep them until existing issues are backfilled with issue types?