Publish security advisories for recent security vulnerabilities

**Is your feature request related to a problem? Please describe.**
I need to know when the cli has a security update so that I can keep my environment secure. I receive alerts on other GitHub projects when security advisories are published, but amplify-cli has not published security advisories. PRs for security issues are also not tagged as security related.

I am left to periodically browse all issues and decipher from the title whether a security issue is being discussed and whether a fix has been released.

This is insufficient however because some people may follow the repo security reporting advice and send an email instead, keeping it off of github. When I last reported a security issue via email, it was fixed with a PR that did not give any indication is was addressing a security issue.

**Describe the solution you'd like**
The security tab in github is already being used to publish a security policy. I would like to see the security advisories tab used as well to inform users when they might need to take action. I’d like to see this back filled with data. The most recent two security incidents I’m aware of might only impact a small amount of users, but issues from last year could have a broader impact.

Some people use Amplify to host secure data where the consequences of an open security issue include serious harm to life.

**Describe alternatives you've considered**
Publishing CVEs would help as well for users who subscribe to Mitre’s notifications.

**Additional context**
I am aware of 4 security fixes I have participated in, and I’m aware of 3 documentation updates that have been made to clarify security limitations. I do not recall in any of these cases a notice to users for the need to at least redeploy their stack.

I’m worried there are many other security issues I am not aware of but are publicly known. It wouldn’t be hard for a bad actor to scan the internets for Amplify-based solutions and check if the application is unpatched.

I’d also strongly like a published advisory for any changes to documentation which discloses a security limitation. These are fixes as well, even if they don’t have code changes.