Add release notes for security

* Document security, especially important caveats
* Some unintentional whitespace cleaning per Emacs