Add a review checklist to CONTRIBUTING.md - #500

Fixes #44

Description

#44 asks for guidelines on what to check when changes are made, especially changes about Core or Security, and checking those with the relevant teams. CONTRIBUTING.md already says every edit needs two reviews, but it doesn't say what reviewers should check.

This adds a short Review Checklist section to CONTRIBUTING.md, following the proposal in the issue thread, instead of a separate guidelines page.

Changes

CONTRIBUTING.md: new "Review Checklist" section between "Assets in Pages" and "Generating Manifest". Before approving or merging, check that:

• Facts link to a source: versions, dates and requirements link to a primary source.
• Core changes match the Core team's documentation: the PHP Compatibility reference and the Requirements page. If unsure, ask in #core.
• Security guidance has been reviewed by someone with security experience: ask for a reviewer in #hosting. Unfixed vulnerabilities are never described in issues or PRs; they are reported as described in .github/SECURITY.md.
• The manifest is up to date for new, renamed or moved pages.
• AI use is disclosed, per the Hosting Team AI Policy (Official AI policy page #431).
• The PR links its issue with Fixes #123.

Notes

• Related PRs. This doesn't overlap with Document the current merge requirements and the 24-hour wait for new GitHub accounts #477, which documents the merge mechanics from the repository security post (two approvals, resolved change requests, 24-hour wait). This PR covers what reviewers check. The section is in a different part of the file, and I test-merged it with Document the current merge requirements and the 24-hour wait for new GitHub accounts #477, Fix manifest generator dropping handbook hierarchy #442 and Update links that only resolve through redirects #476 (the other open PRs that touch CONTRIBUTING.md) with no conflicts.
• No security channel named. There isn't a public Slack channel for the WordPress Security Team, so the checklist points to #hosting for finding a reviewer and to the existing Security Policy for reporting.
• Feedback welcome. Happy to adjust the wording, or to move this into the handbook's Get Involved page if the team prefers.
• No page was added and no title or path changed, so the manifest does not need regenerating.

AI Assisted: AI was used to help review the repository and draft this change.