Ship TRADEMARK.md and SECURITY.md in the source package

Moving the trademark terms out of LICENSE created a regression the release
workflow would have carried: the source zip ships README.md and LICENSE, so a
recipient who only has the zip would get a bare Apache LICENSE with no
trademark reservation attached at all. SECURITY.md rides along so an offline
recipient knows where to report.

Author: WhiteStarSupreme

.github/workflows/release.yml

@@ -111,6 +111,8 @@ jobs:
             setup.py \
             README.md \
             LICENSE \
+            TRADEMARK.md \
+            SECURITY.md \
             --exclude="*.pyc" \
             --exclude="__pycache__/*" \
             --exclude="*.DS_Store" \