doc: mention where to push security commits

Author: RafaelGSS

doc/contributing/releases.md

@@ -249,6 +249,15 @@ each commit from the PR. You will also need to manually apply the PR
 metadata (`PR-URL`, `Reviewed-by`, etc.) by amending the commit messages. If
 known, additionally include `CVE-ID: CVE-XXXX-XXXXX` in the commit metadata.
 
+Push the commits to the `vN.x.x-proposal` branch that has branched off of
+`vN.x`.
+
+```console
+git checkout vN.x
+git checkout -b vN.x.x-proposal
+git cherry-pick  ...  # cherry-pick nodejs-private PR commits directly into the proposal
+```
+
 **Note**: Do not run CI on the PRs in `nodejs-private` until CI is locked down.
 You can integrate the PRs into the proposal without running full CI.