State the support period and add a user information document

[Gorka Gonzalo (d0ubl3g)]

Documentation only.

• SECURITY.md, Supported versions: replaces "Only the latest release receives fixes" with the support rule. From 1.0.0, each major version is supported with security fixes for five years, counted from its first version, and fixes ship in the latest release of that major version. While 0.x is current, fixes go into the latest 0.x release, and 0.x has no end-of-support date until 1.0.0 is released. Security fixes stay available after a HodeiShield subscription ends, since installing or updating never requires one. An end-of-support notice is published twelve months ahead in SECURITY.md, the README's security notice block and the release notes.
• docs/user-information.md (new): one place for the product and version identification, the manufacturer and its contact details, the point of contact for vulnerabilities, the intended purpose, security properties and secure use, known limitations, the support period, how to update through each install channel and turn off the new-version notice, how to remove the CLI and everything it stores, and where the software bill of materials is published and that it is intended for users. Each release's copy is the one in its tag.
• README.md: one sentence on the support rule and a link to the new document.
• CHANGELOG.md: one sentence added to the documentation entry in Unreleased.

Refs #127, #128