Add notes for CVE-2019-6446/python-numpy

The proposed switch will only be in a major bump version, e.g. 1.17.0
and documented in the release notes.

Changing the default in a stable release is not sensible.