Add steps for creating the security and esr branches

doc/5.x-final.md

@@ -78,7 +78,19 @@ To ensure the various tags were published and match the branches, use `civi-git-
 civi-git-table --fetch 5.2.0 5.2
 ```
 
-## 5: Update `versions.json`
+## 5: Mirror the branch (ESR)
+
+If this branch will have future ESR support, then you should setup mirror branches for `esr` and `security`.
+
+```
+givi branch -A 5.X-esr origin/5.X
+givi push -A -u esr 5.X-esr
+
+givi branch -A 5.X-security origin/5.X
+givi push -A -u security 5.X-securty
+```
+
+## 6: Update `versions.json`
 
 Services such as the `civicrm.org` download page and the in-app version
 check depend on a file named `versions.json`. Update this.
@@ -116,7 +128,7 @@ git push origin master
 popd
 ```
 
-## 6: Make new versions visible on download sites
+## 7: Make new versions visible on download sites
 
 If there is a change in ESR status, then:
 

doc/5.x-patch.md

@@ -115,7 +115,17 @@ To ensure the various tags were published and match the branches, use `civi-git-
 civi-git-table --fetch 5.16.0 5.16.1 5.16
 ```
 
-## 5: Update `versions.json`
+## 5: Mirror the branch (ESR)
+
+If this branch will have future ESR support, then ensure that the `esr` mirror is up-to-date.
+
+```
+givi update esr/5.X-esr origin/5.X
+```
+
+<!-- You need to update `esr` mirrors because that's an actual distribution channel for some users. However, the `security` mirrors can be updated more as-needed. -->
+
+## 6: Update `versions.json`
 
 Services such as the `civicrm.org` download page and the in-app version
 check depend on a file named `versions.json`. Update this.