doc: security: Add CVE-2021-3581 to docs

Update release notes for 2.6, and the vulnerabilities page to mention
CVE-2021-3581.  This CVE is under embargo until Sept 4, 2021.

Signed-off-by: David Brown <david.brown@linaro.org>
2 files changed