Release note for curl (#20105)

releasenotes/notes/bump-curl-8.4.0-b99de8b63bcc92a4.yaml

@@ -0,0 +1,11 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+security:
+  - |
+    Bump embedded curl version to 8.4.0 to fix CVE-2023-38545 and CVE-2023-38546