Clarify guidelines on formatting changes in pull requests.

Added contributing guidelines to the README.

fix: avoid panic on invalid signature input

Supersedes junkurihara#30. The `tracing` dependency of the `httpsig` crate is now
gated behind a new `tracing` feature, enabled by default so that existing
users keep their log output.

Unlike junkurihara#30, log call sites are left untouched: the `trace` facade module
now provides no-op macros when the feature is disabled, so a missing cfg
guard can never break a feature combination (junkurihara#30 failed to compile with
`--features rsa-signature` alone). The dependency is also declared with
`default-features = false`, which drops `tracing-attributes` from the
dependency graph since only the bang-style macros are used.

Verified: cargo check/test across default, --no-default-features,
rsa-signature with and without tracing, --all-features, and the whole
workspace.

Co-authored-by: keskalukasfri <[email protected]>

Feat/tracing optional