Say on the home page that 2.0.2 is a security release

Also records why the context externalization machinery stays. AXIS2-6107 scoped
its removal and it should not be done: SessionContext is an HttpSession
attribute that containers serialize when persisting sessions, EndpointReference
round trips only because its custom externalization handles Axiom values that
are not serializable, and persisting a paused MessageContext is a capability
rather than dead code. SECURITY.md item 4 now carries those three reasons so a
scan finding here has a citable answer instead of being re-argued. The Rampart
paragraph also still promised to ship after 2.0.1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>