chore: add professional maintainer governance and security gates

[BLCCoreStudio]

Summary

Adds a maintainer-focused governance and automation layer to TurkishEvalKit while leaving evaluation implementation code unchanged.

Governance and triage

• CODEOWNERS for project-critical surfaces
• SUPPORT.md with research/evaluation-specific triage policy
• Code of Conduct
• structured bug and feature issue forms
• PR template that explicitly flags methodology and historical-comparability impact

Security and dependency maintenance

• Python CodeQL on pushes, PRs, a weekly schedule, and manual runs
• Dependabot auto-merge restricted to SemVer patch updates

Releases

• generated release-note categories, including a dedicated evaluation/methodology section

Safety

Methodology changes, minor updates, and major dependency updates remain maintainer-reviewed. Existing CI and evaluation workflows are unchanged.

Follow-up

Dependency Review is intentionally deferred until GitHub Dependency Graph is enabled for the repository.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.