Add docs on how to create a patch set to apply to master for security releases

I'm not sure what others have been doing, but I think this worked for me last time around.

/cc: @winh, @mkozono