vtls: have vtls.h include the backend header files

It turned out some features were not enabled in the build since for
example url.c #ifdefs on features that are defined on a per-backend
basis but vtls.h didn't include the backend headers.

CURLOPT_CERTINFO was one such feature that was accidentally disabled.
RELEASE-NOTES: synced with 6637b237e6eb

... and bumped the planned release version.
RELEASE-PROCEDURE: better markdown, more content
SECURITY: slightly nicer markdown format