[meta] add DCO

imo this shouldn‘t be necessary, as it should be implied by the act of making a PR.

Following the example in expressjs/express#6048

See openjs-foundation/project-status#2

Author: ljharb

CONTRIBUTING.md

@@ -113,3 +113,11 @@ Co-authored-by: Name Here <email@here>
 
 # Where can I ask for help?
 If you have any questions, please contact [@LJHarb](mailto:[email protected]).
+
+# Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+ (a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or
+ (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or
+ (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it.
+ (d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved.