Initial strawman for the 1.8.1 release notes

Ps since we have no history of covering security vulnerabilities and this
is old news (10/14), there's always the option to leave it out. We haven't
had 100 people ask about this and posting something late as a part of
release notes adds coupling that isn't natural since 1.8.1 has nothing to
do with this.

It is probably better to make a separate announcement if we feel further
investment on this topic is actually worthwhile.