doc: update Code of Conduct to Contributor Covenant 3.0 - #1097

Contributor Covenant 3.0 restricts "sharing or acting on someone's
personal or private information without their permission", but does not
say how that interacts with reporting an incident. Read narrowly, it
leaves a reporter unsure whether forwarding a harassing direct message to
report@nodejs.org is itself a violation.

v3.0 also drops two v2.0 clauses that covered private conduct:

  * "Public or private harassment"
  * "Other conduct which could reasonably be considered inappropriate in
    a professional setting"

v3.0's harassment restriction requires an explicitly expressed boundary
or a prior request to stop, so publishing a private communication in
order to win a public argument is no longer clearly covered by anything
other than the catch-all.

This adds a Node.js-specific Confidentiality section that:

  * exempts information shared with the Moderation Team when reporting or
    investigating, so forwarding a private message to report@nodejs.org
    is never itself a violation
  * reads "personal or private information" to include statements made in
    a private setting, not only identifying details
  * distinguishes describing someone's conduct toward you, which is not a
    disclosure, from republishing their private words to apply pressure
    or to enlist their view, which is

Upstream v3.0 text is left byte-identical so future updates stay easy to
diff. Kept as a separate commit so it can be dropped independently of the
Contributor Covenant 3.0 upgrade.