security.7: add caveat about interim sysctl paths from r355436

r355436 moved mitigation sysctls to machdep.mitigations but did not
rationalize the sense of the invidual knobs. Clarify that the old
names remain the canonical way to set these mitigations.

Backwards compatibility will be maintained for the original names
(e.g. hw.ibrs_disable), but not from the interim names
(e.g. machdep.mitigations.ibrs.disable).

Sponsored by: The FreeBSD Foundation