proposals: release approval process explain security@ email

Expand a bit more information about the security@ alias and who is
involved in a security sensitive release.

GOVERNANCE.md

@@ -10,7 +10,7 @@ OCI projects need a standard process for making releases so the community of mai
 
 ## Security fixes
 
-Security fix releases MUST use [email protected] instead of [email protected], but should otherwise follow the standard [list-based voting process](#list-based-voting).
+Security fix releases MUST use [email protected] instead of [email protected], but should otherwise follow the standard [list-based voting process](#list-based-voting). The [email protected] email includes all members of the TOB; the TOB will guide the security sensitive release with project maintainers.
 
 ## Parallel proposals