doc: update instructions for cc

- update intructions on adding cc for email to
  nodejs-sec mailing list as UI does not allow it
  to be done directly.

Signed-off-by: Michael Dawson <mdawson@devrus.com>

PR-URL: #39674
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Author: mhdawson

doc/guides/security-release-process.md

@@ -43,7 +43,6 @@ information described.
   * Described in the pre/post announcements
 
 * [ ] Pre-release announcement [email][]: ***LINK TO EMAIL***
-   * CC: `oss-security@lists.openwall.com`
    * Subject: `Node.js security updates for all active release lines, Month Year`
    * Body:
   ```text
@@ -52,6 +51,12 @@ information described.
   ```
   (Get access from existing manager: Ben Noordhuis, Rod Vagg, Michael Dawson)
 
+* [ ] CC `oss-security@lists.openwall.com` on pre-release
+
+The google groups UI does not support adding a CC, until we figure
+out a better way, forward the email you receive to
+`oss-security@lists.openwall.com` as a CC.
+
 * [ ] Pre-release announcement to nodejs.org blog: ***LINK TO BLOG***
   (Re-PR the pre-approved branch from nodejs-private/nodejs.org-private to
   nodejs/nodejs.org)