MFC r355423: UPDATING: Add [less] long-belated note about certs in base

While the interaction between this and the ETCSYMLINK option of
security/ca_root_nss isn't necessarily fatal, one should be aware and
attempt to understand the ramifications of mixing the two.

ports-secteam will be contacted to discuss the default option for branches
where certs are being included in base.