Add commitlint - use conventional commits consistently

[BlasiusSecundus]

This PR proposes to use Conventional Commits on the project from now on and enforce this via the CI.

Commit messages are validated by the CI for each pull request, and aslo adds an easy way to set up a git hook for local development (to catch violations before comitting).

Also adds separated contributing guideline file. Moved there the Contributions section from the readme, as well as added a section about commit messages / commitlint.

Note:

• Bots may need to be configured to commit according to the specs (but as I see renovate already does that).
• The "from" commit may also need to be changed depending on the time of merging.

Question / Potential improvements:

• Is it possible to dynamically check only new commits added by the actual PR?

[oliemansm]

Looking good to me, all for it!

[BlasiusSecundus]

Some improvements since the first version:

• get HEAD commit from the target repository dynamically (instead of hardcoding the commit hash)
• run npm audit to check for vulnerabilities in NPM packages installed for commitlint

Some minor adjustments to the workflow:

• test now depends on commitlint and verify-google-java-format tasks (do not run lengthy test jobs when the build already considered to be failed)
• sonar depends on test task (avoid "pollution" of sonar results from failed builds)