Add .asf.yaml with baseline repository configuration

[CalvinKirs]

What

Adds a .asf.yaml so the project can self-manage its GitHub repository settings through ASF Infra automation, per the ASF Infra .asf.yaml documentation.

This PR intentionally covers only the baseline:

• Repository metadata: description, homepage (https://sourcelume.apache.org), and topic labels centered on the project's core — training-data provenance, dataset licensing, and verifiable attestation.
• Merge buttons: squash only (merge and rebase disabled) to keep a linear history.
• Branch protection: minimal protection on main (blocks force pushes and branch deletion).

The file carries the standard ASF license header, so mvn verify (RAT) passes without adding an exclusion.

Out of scope — needs community discussion

Deliberately not configured yet; each deserves its own thread before we commit:

• required_status_checks / required_pull_request_reviews on main

Happy to follow up once those are agreed on the dev list.

[jgoodyear]

Thank you - and yes, please start the conversations on dev@ list.