I think this is the wrong question when scoping to this problem, as governance and politics are not static. A favorable country to operate out of today is perhaps not favorable tomorrow. I think the better question is: "How do you operate an open source project with global contributors in a way that makes you censorship resistant?"

You should have no single point of failure, folks should be signing their commits (cryptographic integrity), build the merkle tree, make it broadly consumable, etc. If a POP gets nuked, you bring up a replacement and keep on chuggin', just like if you were The Pirate Bay, Archive.today, Libgen, Z-Library, etc. Some similarities to how the AT Protocol is structured (Commits->PDS->Firehose->AppView) [1]. Commits go in, views of the project are available globally, the data corpus is stored in a durable, distributed fashion.

[1] https://en.wikipedia.org/wiki/AT_Protocol#/media/File:Bluesk...

Which country protected Assange? Oops, also not recommended. So none.

Iceland ?