Improve auxiliary support files

Author: vy

CODE_OF_CONDUCT.md

@@ -14,4 +14,5 @@
  See the License for the specific language governing permissions and
  limitations under the License.
 -->
+
 See [the Apache Software Foundation's Code of Conduct](https://www.apache.org/foundation/policies/conduct.html).

RELEASE-NOTES.md

@@ -0,0 +1,18 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+See [the Release Notes page](https://logging.apache.org/log4j/2.x/release-notes.html).

SECURITY.md

@@ -1,13 +1,18 @@
-# Security Policy
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
 
-## Supported Versions
+      http://www.apache.org/licenses/LICENSE-2.0
 
-Only the most recent release of Apache Log4j 2 is supported.
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
 
-## Reporting a Vulnerability
-
-If you have encountered an unlisted security vulnerability or other unexpected behaviour that has security impact, please report them privately to the [Log4j Security Team](mailto:[email protected]).
-
-## Past Vulnerabilities
-
-See [Apache Log4j Security Vulnerabilities](https://logging.apache.org/log4j/2.x/security.html).
+See [the Security page](https://logging.apache.org/log4j/2.x/security.html).