Add guidance on open sourcing without publishing individual user emails

[sarahcollyer]

Publications are no longer including individual contact details, and we're being advised generally to not share our individual contact details. Open sourcing can mean individual email addresses are shared, so we should add guidance on how to prevent/undo this.

Guidance should at least cover:

• Keeping your email address private when committing
• Rewriting history to remove emails from old commits
• Mirror repos (private for dev and a public one with a generic team contact)