remove security@orc.apache.org from text

[raboof]

this list was shut down per https://issues.apache.org/jira/browse/INFRA-26782

[dongjoon-hyun]

If you look at the JIRA issue title and discussion closely, it ended up to keep it officially by forwarding, @raboof .

ASF Infra team needs to monitor security@orc.

[raboof]

If you look at the JIRA issue title and discussion closely, it ended up to keep it officially by forwarding, @raboof .

Indeed all security@*.apache.org are forwarded to security@apache.org as a failsafe.

We would still prefer reporters to report directly to security@apache.org instead of security@orc.apache.org, since if we see security@orc.apache.org we might make a mistake and incorrectly assume the project is monitoring that list.

ASF Infra team needs to monitor security@orc.

(It's actually the ASF Security team, not the Infra team - but yes we're monitoring it).