[ci] Include Secure Boot ISO and USB images in release artifacts

Signed-off-by: Michael Brown <mcb30@ipxe.org>

.github/workflows/build.yml

@@ -588,4 +588,7 @@ jobs:
           gh release create "${{ github.ref_name }}" --verify-tag --draft \
               --title "$(cat version/relname.txt)" \
               --notes-file version/relnotes.md \
-              bin-combi/ipxe.iso bin-combi/ipxe.usb bin-combi/ipxeboot.tar.gz
+              bin-combi/ipxe.iso bin-combi/ipxe.usb \
+              bin-combi/ipxe-arm64-sb.iso bin-combi/ipxe-arm64-sb.usb \
+              bin-combi/ipxe-x86_64-sb.iso bin-combi/ipxe-x86_64-sb.usb \
+              bin-combi/ipxeboot.tar.gz

RELNOTES.tmpl.md

@@ -4,18 +4,44 @@ Downloads
 Binaries
 --------
 
-  - [ipxe.iso][iso] (Bootable ISO image)
-  - [ipxe.usb][usb] (Bootable USB or SD card image)
-  - [ipxeboot.tar.gz][netboot] (Network boot server files)
+### ISO images
+
+These ISO9660 images may be burned to a real CD-ROM, or be attached as
+virtual media.
+
+  - [`ipxe.iso`][iso] (All CPU architectures, BIOS/UEFI, no UEFI Secure Boot)
+  - [`ipxe-x86_64-sb.iso`][isox64] (x86-64 UEFI Secure Boot only)
+  - [`ipxe-arm64-sb.iso`][isoaa64] (AArch64 UEFI Secure Boot only)
+
+### USB images
+
+These FAT filesystem images may be burned to a mass storage device
+such as a USB stick or SD card, or be attached as virtual media.  You
+can edit the included `autoexec.ipxe` script to control the boot
+process.
+
+  - [`ipxe.usb`][usb] (All CPU architectures, BIOS/UEFI, no UEFI Secure Boot)
+  - [`ipxe-x86_64-sb.usb`][usbx64] (x86-64 UEFI Secure Boot only)
+  - [`ipxe-arm64-sb.usb`][usbaa64] (AArch64 UEFI Secure Boot only)
+
+### Network boot server files
+
+This archive image may be extracted to a TFTP or HTTP(S) server.
+
+  - [`ipxeboot.tar.gz`][netboot] (All CPU architectures, BIOS/UEFI)
 
 [iso]: ${BINURL}/ipxe.iso
+[isoaa64]: ${BINURL}/ipxe-arm64-sb.iso
+[isox64]: ${BINURL}/ipxe-x86_64-sb.iso
 [usb]: ${BINURL}/ipxe.usb
+[usbaa64]: ${BINURL}/ipxe-arm64-sb.usb
+[usbx64]: ${BINURL}/ipxe-x86_64-sb.usb
 [netboot]: ${BINURL}/ipxeboot.tar.gz
 
 Source code
 -----------
 
-  - [${SRCNAME}.tar.gz][tarball]
+  - [`${SRCNAME}.tar.gz`][tarball]
 
 [tarball]: ${SRCURL}.tar.gz