CONTRIBUTING: Clarifications on how to handle license deviations

CONTRIBUTING: Clarifications on how to handle license deviations

This patch makes a few clarifications which were discussed on
IRC recently.

Specifically:
- Highlight the principle that license deviations
  should be brought to the attention of maintainers
- Add a requirement for GPLv2 compatibility
- Restructure the document to highlight use-cases for
  "New components" and "Importing code" clearer
- Add conventions and instructions for "New files"

Signed-off-by: Lars Kurth <lars.kurth@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Julien Grall <julien.grall@arm.com>