release.md: note that we do two security releases Note that for security releases, we update the two most recent major release branches.