fixup might as well link the website too

project/security.md

@@ -62,11 +62,11 @@ To mitigate such risks, we apply established procedures and techniques:
   repository is readable or is otherwise small and documented. There is no
   place anywhere for any hidden encrypted payload.
 - **Reproducible builds**. curl releases are shipped as tarballs that are
-  hosted on the curl website. We provide documentation, docker setups and
-  configurations etc that allows anyone wanting to easily reproduce our
-  release builds to generate identical images - proving that what we ship is
-  only contents taken from the git repository plus other correct and properly
-  generated contents.
+  hosted on the curl website (<https://curl.se). We provide documentation,
+  docker setups and configurations etc that allows anyone wanting to easily
+  reproduce our release builds to generate identical images - proving that
+  what we ship is only contents taken from the git repository plus other
+  correct and properly generated contents.
 - **Signed commits**. Over 90% - not all - of recent commits were signed to
   help prove provenance. Signing commits is not yet a mandatory requirement
   for committers but we hope to voluntarily increase the share over time and