Add details in CONTRIBUTING.md specifying conditions for a PR to be merged

[tomjenkinson]

Do we want to require a review from a commit author before working on issues that are not in the master branch?

Do we want to disable branch protection on master so a committer can directly merge to master? Do we want to require some kind of notification to jta-dev and a period defined in hours/days?

Any other suggestions?

[tomjenkinson]

For future reference, here are some details that @gregw shared on a Jakarta related mailing list related to servlet-api guidelines: https://github.com/eclipse-ee4j/servlet-api/blob/master/CONTRIBUTING.md#project-contribution-guidelines