README: update links

The link to the FCP spec was outdated; the security site has since gone
offline.