docs(contributing): accept a known identity in the sign-off

[MiMoHo]

The "Sign your work" section asks for a real name: "Use your real name (sorry, no pseudonyms or anonymous contributions)." This PR changes that to a known identity, the way the Linux kernel and Git handle it today. Anonymous contributions are still not accepted, but a pseudonym used consistently, such as the GitHub username, is fine, and so is the GitHub no-reply address.

Whoever fixes a bug in Nextcloud is likely to run Nextcloud. With a real name in a public commit, finding that person, and their server if it runs under a personal domain, takes a few searches. Nextcloud's own security scan then rates any public server against the list of known vulnerabilities. It is meant to help admins, but it answers the same question for anyone else. The record can't be taken back either: with the sign-off, contributors agree that "a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely" (DCO, point d). Asking only for what the sign-off needs is also what data minimisation in Art. 5(1)(c) GDPR expects.

What the sign-off needs is a person you can get back to. When Linus Torvalds changed the kernel wording in 2023, he wrote that the sign-off "needed to be something we could check back with" and that "we've always accepted nicknames" (commit, acked by Greg Kroah-Hartman and Michael Dolan of the Linux Foundation). Git followed in 2025: "The goal of this policy is to allow us to have sufficient information to contact you if questions arise about your contribution" (SubmittingPatches). A GitHub account gives exactly that.

Some objections I expect:

• "A real name makes the sign-off legally stronger." The DCO text doesn't ask for one. It certifies where the code comes from. Nobody checks whether a name is real, so the rule only binds honest contributors. If a dispute ever needs the person behind an account, GitHub discloses account data on a valid subpoena or court order (GitHub guidelines).
• "Pseudonyms let attackers in, look at xz." The xz backdoor shipped in release tarballs that a contributor named "Jia Tan" created and signed. A real-name rule would not have stopped that, because a made-up name looks like any other. What protects the project is review, and this PR doesn't change that.
• "We need to reach contributors, for example for relicensing." A GitHub account can always be reached with a mention. An email address in an old commit is no guarantee of reaching someone either.

Ten repositories still carry their own copy of this sentence: server, spreed, deck, talk-android, all-in-one, appstore, cms_pico, context_chat, context_chat_backend and profiler. This file was added in 2021 as a global CONTRIBUTING.md for all repositories of the organisation, but GitHub only shows it where a repository has no file of its own (docs). In context_chat and context_chat_backend the file is a copy of this one, only the copyright year differs, so removing it there would be enough. The other repositories could link to this section instead of repeating it. Then a change here reaches all of them without a separate PR for each.

@AndyScherzinger, you added the AI policy check to notes and brought it up to date in server. Would it make sense to handle these copies the same way?

If the AI Policy check fails on this PR, that is #767: runs from forks can't add the "AI assisted" label. #815 fixes that.

🤖 AI (if applicable)

• The content of this PR was assisted using AI

AI-Assisted-By: Claude Opus 5.5 (xhigh)

The model helped me collect the sources and draft the change. I reviewed and edited everything. The commit carries the same line as a trailer.