Include Fred's release notes for 1.4.0.

@fredlf is unfortunately out of power and internet because of storms :(

ping @jamtur01 @SvenDowideit @crosbymichael @tiborvass 

I left this in because:

1. We were releasing more or less concurrently so I wanted to be sure people knew the security fixes were in 1.4.0 in case they didn't bother looking at 1.3.3.
2. We said publicly this was a bug fix and hardening release and I didn't have anything else to put in RN to back that up.