Update "Contributing" Notes and One Github Action

Replace one deprecated action, and update "How to release".

Author: oleibman

.github/workflows/main.yml

@@ -210,7 +210,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 

CONTRIBUTING.md

@@ -4,6 +4,7 @@ If you would like to contribute, here are some notes and guidelines:
 
  - All new development should be on feature/fix branches, which are then merged to the `master` branch once stable and approved; so the `master` branch is always the most up-to-date, working code
  - If you are going to submit a pull request, please fork from `master`, and submit your pull request back as a fix/feature branch referencing the GitHub issue number
+  - Install (development) dependencies by running `composer install` inside your PhpSpreadsheet clone.
  - The code must work with all PHP versions that we support.
    - You can call `composer versions` to test version compatibility. 
  - Code style should be maintained.
@@ -39,7 +40,10 @@ This makes it easier to see exactly what is being tested when reviewing the PR.
     2. Tag subject must be the version number, eg: `1.2.3`
     3. Tag body must be a copy-paste of the changelog entries.
 3. Push the tag with `git push --tags`, GitHub Actions will create a GitHub release automatically, and the release details will automatically be sent to packagist.
-4. Github seems to remove markdown headings in the Release Notes, so you should edit to restore these.
+4. By default, Github remove markdown headings in the Release Notes. You can either edit to restore these, or, probably preferably, change the default comment character on your system - `git config core.commentChar ';'`.
 
-> **Note:** Tagged releases are made from the `master` branch. Only in an emergency should a tagged release be made from the `release` branch. (i.e. cherry-picked hot-fixes.)
+> **Note:** Tagged releases are made from the `master` branch. Only in an emergency should a tagged release be made from the `release` branch. (i.e. cherry-picked hot-fixes.) However, there are 3 branches which have been updated to apply security patches, and those may be tagged if future security updates are needed.
+- release1291
+- release210
+- release222