Update organization files to meet cnabio requirements

[silvin-lubecki]

• Add a governance file Add a GOVERNANCE file  #92
• Replace maintainers file with CODEOWNERS Replace out-of-date MAINTAINERS file with brand new CODEOWNERs #93
• Update Contributing file Update CONTRIBUTING.md to better fit with other cnabio libraries. #91
• Update go imports from docker/cnab-to-oci to cnabio/cnab-to-oci Rename imports to cnabio/cnab-to-oci #94
• Add a code of conduct? If so which one?
• Configure @vdice release note script

[silvin-lubecki]

^ @vdice Can I let you handle the release note script?

[vdice]

@silvin-lubecki Here is an example of the script we use in Brigade: https://github.com/brigadecore/brigade/blob/master/brigade.js#L166-L173

It is a combination of shell (git cli and github-release cli invocations) to derive the commits since the last tag and then create the GH release. Unfortunately, the latter github-release tool appears to be unmaintained. There is a security patch I've PRed that has garnered no attention and, after a recent use, I received an email from GitHub indicating that the CLI's way of appending the token as a query parameter is deprecated and will be invalidated by July of this year (instead, the token should be placed in an Authorization header). I might play around with forking the project and making that refactor... but we should also investigate other CLIs we can use in its stead. edit: the latter issue was a straightforward fix: vdice/github-release#1

[silvin-lubecki]

Thank you @vdice, do you suggest then that we should use your fork?

[vdice]

@silvin-lubecki let's save the fork approach for a plan B... meanwhile, I'm looking into an alternate tool that looks to have more recent activity: https://github.com/tcnksm/ghr . I'll test this out and report back...

Longer term, it looks like https://github.com/cli/cli will end up being the best choice (assuming creation/maintenance of releases will be added.)

[vdice]

@silvin-lubecki the ghr cli referenced above looks good; tested well on a project of mine. PR adding to the circleci config in #97

[carolynvs]

Looks like @vdice is destined to be a contributor to the gh CLI 😀