security announces

[justin at shiningsilence.com]

> (1) We will post security announcements to users@ and kernel@ affecting
> the release branch. We might not post them if they only affect PREVIEW
> or DEVELOPMENT, those using them are supposed to follow commits@ or
> update the system at regular times. It doesn't mean that we never send
> out such messages, just don't depend on it :)

Since I'm already working on a way to automate extraction of changes to a
particular branch from commit mails, would it be worthwhile to format
security fixes a certain way, so that they can also be auto-listed?