Add instructions for filing a restricted-access Bugzilla bug as an

alternative method for security reports instad of private email, which
some people have trouble with due to greylisting.  ok djm@

openssh/report.html

@@ -32,15 +32,19 @@ <h3>Released versions problem reports</h3>
 href="https://bugzilla.mindrot.org/buglist.cgi?product=Portable+OpenSSH&amp;bug_status=RESOLVED">
 bugs fixed since the last release</a> and
 <a
-href="https://bugzilla.mindrot.org/showdependencytree.cgi?id=V_9_3">
+href="https://bugzilla.mindrot.org/showdependencytree.cgi?id=V_10_0">
 known bugs reported since the last release</a>.
 </ol>
 
 <p>
 If nothing looks like it addresses your problem, then use
-<a href="https://bugzilla.mindrot.org">Bugzilla</a>
-to submit a bug report (but see below for reporting security
-bugs privately).
+<a href="https://bugzilla.mindrot.org">Bugzilla</a> to submit a bug report.
+Security bugs can be reported directly to the developers using the openssh@
+address below, or by filing a restricted access bug by selecting the <a
+href="https://bugzilla.mindrot.org/enter_bug.cgi?groups=Portable%20OpenSSH">
+Portable OpenSSH Bugs Access</a> checkbox.
+Note that neither is a method for obtaining private support for general
+problems, any such reports will immediately be made public.
 
 <p>
 You can reach the OpenSSH developers by sending email to one of