The commit adds a link to https://pkg.go.dev/github.com/ulikunitz/xz as
proposed by github user @89z

Fixes: Issue #41

Issue #43 asks for simple examples for reading and writing files. These
examples have been added to example_test.go.

As Matt Dainty (@bodgit) reported there is an issue if the header of the
LZMA stream is less than the minimum dictionary size of 4096 byte. The
specification of the LZMA format says that in that case a dictionary
size of 4096 byte should be used, our code returns an error.

This commit changes the behavior and adds a simple test case to test for
the right behavior.

Fixes [#52](#52)

The commit contains copyright updates and the release notes for the new
version.

There has been a supply chain attack against the original xz
implementation,
[CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094).

README.md has been updated to clarify that this implementation is not
affected. SECURITY.md supports now Github's private security reports.

@kodawah raised the problem that xz.Writer.Close doesn't close the
underlying writer. Instead of changing the behavior of the Writer I
added WriteCloserStack in a new package to address the problem.

fixes: #61

This commit addresses security issue GHSA-jc7w-c686-c4v9.

The mitigating measures are described for the Reader type and I added a
TestZeroPrefixIssue function to test the mitigations.

// # Security concerns
//
// Note that LZMA format doesn't support a magic marker in the header. So
// [NewReader] cannot determine whether it reads the actual header. For instance
// the LZMA stream might have a zero byte in front of the reader, leading to
// larger dictionary sizes and file sizes. The code will detect later that there
// are problems with the stream, but the dictionary has already been allocated
// and this might consume a lot of memory.
//
// Version 0.5.14 introduces built-in mitigations:
//
//   - The [ReaderConfig] DictCap field is now interpreted as a limit for the
//     dictionary size.
//   - The default is 2 Gigabytes (2^31 bytes).
//   - Users can check with the [Reader.Header] method what the actual values are in
//     their LZMA files and set a smaller limit using [ReaderConfig].
//   - The dictionary size doesn't exceed the larger of the file size and
//     the minimum dictionary size. This is another measure to prevent huge
//     memory allocations for the dictionary.
//   - The code supports stream sizes only up to a pebibyte (1024^5).

The commit includes preparations for the release v0.5.14 including go
fmt, release notes and updates to TODO.md.