Restricting External Contributions to cloud.gov Repositories

[wz-gsa]

Changes proposed in this pull request:

• Updated CONTRIBUTING.md to clarify contribution eligibility.
• Documented Cloud.gov's policy to accept contributions only from U.S. government-affiliated individuals and entities.
• Aligned contribution policy with our current compliance, trust, and supply chain risk posture.

Things to check

• For any logging statements, is there any chance that they could be logging sensitive data?
• Are log statements using a logging library with a logging level set? Setting a logging level means that log statements "below" that level will not be written to the output. For example, if the logging level is set to INFO and debugging statements are written with log.debug or similar, then they won't be written to the output, which can prevent unintentional leaks of sensitive data.

Security considerations

This update explicitly restricts contributions to vetted individuals affiliated with the U.S. government. It mitigates risks associated with:

• Implicit federal endorsement of unaffiliated contributors.
• Potential social engineering or credential laundering using commit history.
• Supply chain risks introduced by unsolicited or unverifiable code contributions.

This change reinforces cloud.gov’s trusted platform posture and supports compliance with FedRAMP, CISA guidance, and zero trust principles.