Update SECURITY.md and remove support for 2.x version (#4683)

SECURITY.md

@@ -8,7 +8,7 @@ Security vulnerabilities should be disclosed to the project maintainers through
 
 Responsible disclosure of security vulnerabilities is rewarded through a bug bounty program on [Immunefi].
 
-There is a bonus reward for issues introduced in release candidates that are reported before making it into a stable release.
+There is a bonus reward for issues introduced in release candidates that are reported before making it into a stable release. Learn more about release candidates at [`RELEASING.md`](./RELEASING.md).
 
 ## Security Patches
 
@@ -30,9 +30,10 @@ Only critical severity bug fixes will be backported to past major releases.
 
 | Version | Critical security fixes | Other security fixes |
 | ------- | ----------------------- | -------------------- |
-| 4.x     | :white_check_mark:      | :white_check_mark:   |
+| 5.x     | :white_check_mark:      | :white_check_mark:   |
+| 4.9     | :white_check_mark:      | :x:                  |
 | 3.4     | :white_check_mark:      | :x:                  |
-| 2.5     | :white_check_mark:      | :x:                  |
+| 2.5     | :x:                     | :x:                  |
 | < 2.0   | :x:                     | :x:                  |
 
 Note as well that the Solidity language itself only guarantees security updates for the latest release.