[PATCH] doc: relax requirement on commit messages of security fixes

[Thomas Monjalon]

We missed this patch, there was no comment.
Please review.

10/03/2022 18:59, luca.boccassi at gmail.com:
> From: Luca Boccassi <bluca at debian.org>
> 
> Allow more flexibility with embargo lifting by not requiring
> mentions of CVEs in commit messages if the lift date allows
> it.
> 
> Signed-off-by: Luca Boccassi <bluca at debian.org>
> ---
> -The CVE id and the bug id must be referenced in the patch.
> +The CVE id and the bug id must be referenced in the patch if there is no
> +embargo, or if there is an embargo, but it will be lifted when the release
> +including the patch is published. If the embargo is going to be lifted after the
> +release, then the CVE and bug ids must be omitted from the commit message.