Don't cross-post security advisories to oss-security

Don't cross-post security advisories to oss-security

We should send any security advisory to oss-security separately and not
cross-post it with our own lists.

We also change the text to say that security advisories should be sent to
support-announce regardless of whether a premium release has been affected.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/139)