Update contributing.md to warn against rebasing an open PR.