OSS-Fuzz submission: replace placeholder primary_contact / auto_ccs in project.yaml before upstream PR

[CryptoJones]

Why

.github/oss-fuzz/project.yaml ships with placeholder contact addresses:

```yaml
primary_contact: "security@example.invalid"
auto_ccs:

• "security@example.invalid"
  ```

These need to be real maintainer emails before submitting to google/oss-fuzz — OSS-Fuzz emails the listed contacts directly when crashes are found, with an embargo of 90 days from notification. Bad contact = no notification = embargo expires unnoticed.

What's blocking

This is an external-contact decision (whose inbox monitors OSS-Fuzz reports?) that lives outside the codebase. Owner needs to pick the address(es) before the submission moves forward.

Reference

• docs/security/OSS_FUZZ.md — the integration plan, checklist, and `.github/oss-fuzz/` directory layout.
• Sprint 10 carries the submission as a separate task in SprintPlanning.md.

Next steps after this is unblocked

1. Update project.yaml with the real contact(s).
2. Fork google/oss-fuzz.
3. Create projects/ghidra-decompiler/ containing the three files from this repo's .github/oss-fuzz/.
4. Open the upstream PR per their CONTRIBUTING.md.
5. Verify the first trial-run on OSS-Fuzz infrastructure.
6. Repeat for projects/ghidra-loader/ (JVM project, Jazzer harnesses) once the C++ side is green.