Add governance documentation for SEP-1730 (#808)

Add governance documentation required for SEP-1730 tier compliance:

- DEPENDENCY_POLICY.md: Conservative update policy for Maven dependencies
- VERSIONING.md: SemVer policy with breaking/non-breaking definitions
- ROADMAP.md: 2025-11-25 spec implementation focus and v1.x development
- .github/dependabot.yml: Monthly updates with frozen production dependencies

This mirrors the TypeScript SDK PR structure while being adapted for the Java context.

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+    - package-ecosystem: 'github-actions'
+      directory: '/'
+      schedule:
+          interval: monthly
+    - package-ecosystem: 'maven'
+      directory: '/'
+      schedule:
+          interval: monthly
+      open-pull-requests-limit: 10
+      ignore:
+          # Freeze production dependencies of mcp-core
+          - dependency-name: 'org.slf4j:slf4j-api'
+          - dependency-name: 'com.fasterxml.jackson.core:jackson-annotations'
+          - dependency-name: 'tools.jackson.core:jackson-databind'
+          - dependency-name: 'io.projectreactor:reactor-bom'
+          - dependency-name: 'io.projectreactor:reactor-core'
+          - dependency-name: 'jakarta.servlet:jakarta.servlet-api'
+          # mcp-json-jackson2 and mcp-json-jackson3 dependencies
+          - dependency-name: 'com.fasterxml.jackson.core:jackson-databind'
+          - dependency-name: 'com.networknt:json-schema-validator'