Move the development line to 0.5.x-dev. That covers the branch aliases,
the packages' requirements on each other (^0.5@dev), and the root path
repository versions. The two packages first published with this
release, crystoline/xpsr-lock and crystoline/xpsr-notifications, then
require the 0.5 framework they were written for.

Record 0.5.0 in the changelog. Nothing in it breaks; the one thing to
check is that rate limits can write var/locks, which UPGRADE.md covers
in its steps from 0.4 to 0.5.

SECURITY.md now says what a reporter can expect, and when. A security
fix is released at once as a patch release of the latest minor version,
without waiting for the next feature release.