Handle Security Releases

[blink1073]

Problem

It is awkward to make silent security releases. We can't currently use releaser and we either need to remember to add the changelog entry after the fact, or manually set the version when making the next release.

Proposed Solution

Add a workflow on releaser that creates a silent release with a placeholder entry in the changelog. This placeholder would be honored by the next release target. Additionally, once the security advisory is published, we could add a workflow that updates the changelog with a link to the published advisory, and creates the public GitHub release.

Additional context

Example of a manual GitHub release and changelog PR.