Refactor security page

[vy]

This implements the following changes in the security page:

• Switched to using the Maven version range syntax to denote affected versions
• Switched from MITRE to NVD – Both are in essence funded by the same organization (i.e., the U.S. Government) and contain identical data. Though MITRE seems dead and NVD looks alive with more bells and whistles.
• Switched to CVSS 3.x severity and metrics
• Improved navigation with more user-centric sections and expanded menu
• Added "Components affected" (e.g., log4j-core) field
• Added "Versions fixed" field
• Removed duplicate content
• Simplified textual content – kept basic description and mitigation techniques
• Removed mitigation techniques worded as "alternatively you can do X, but it won't really help"

Review aid

• Old security.md
• New security.adoc

References

• Structuring and wording are inspired by the PostgreSQL Security page.
• This work is a part of the [MS5] SBOM Support & Security #1707 bundle.

[jvz]

Reads well to me. Thanks for organizing this!