on the NTP security issues and fixes

[Daniel Franke]

I've updated the NEWS file with security notes. Mark, you're now "GO"
from me for tagging a release, though it sounds like others may still
be getting last-minute fixes in. The release notes are currently
dominated by discussion of bugs we've inherited and work we've
forward-ported from Classic, but looking through the commit history I
see lots of other work going on which Eric or Amar may want to
mention.