SECURITY.md: Add reference to grpc-netty-shaded

Many people going to the troubleshooting section would be fixed by
swapping to grpc-netty-shaded, so we should call that out.

Author: ejona86

SECURITY.md

@@ -325,6 +325,21 @@ If you aren't using gRPC on Android devices, you are most likely using `grpc-net
 
 If you are developing for Android and have a dependency on `grpc-netty`, you should remove it as `grpc-netty` is unsupported on Android. Use `grpc-okhttp` instead.
 
+If you are using `musl` libc (e.g., with Alpine Linux), then
+`netty-tcnative-boringssl-static` won't work. There are several alternatives:
+ - Use [netty-tcnative-alpine] (https://github.com/pires/netty-tcnative-alpine)
+ - Use a distribution with `glibc`
+
+If you are running inside of an embedded Tomcat runtime (e.g., Spring Boot),
+then some versions of `netty-tcnative-boringssl-static` will have conflicts and
+won't work. You must use gRPC 1.4.0 or later.
+
+Most dependency versioning problems can be solved by using
+`io.grpc:grpc-netty-shaded` instead of `io.grpc:grpc-netty`, although this also
+limits your usage of the Netty-specific APIs. `io.grpc:grpc-netty-shaded`
+includes the proper version of Netty and `netty-tcnative-boringssl-static` in a
+way that won't conflict with other Netty usages.
+
 Find the dependency tree (e.g., `mvn dependency:tree`), and look for versions of:
  - `io.grpc:grpc-netty`
  - `io.netty:netty-handler` (really, make sure all of io.netty except for
@@ -337,12 +352,6 @@ If you have both `netty-handler` and `netty-tcnative-boringssl-static` dependenc
 
 If you have other `netty` dependencies, such as `netty-all`, that are pulled in from other libraries, then ultimately you should make sure only one `netty` dependency is used to avoid classpath conflict. The easiest way is to exclude transitive Netty dependencies from all the immediate dependencies, e.g., in Maven use `<exclusions>`, and then add an explict Netty dependency in your project along with the corresponding `tcnative` versions. See the versions table below.
 
-If you are using `musl` libc (e.g., with Alpine Linux), then `netty-tcnative-boringssl-static` won't work. There are several alternatives:
- - Use [netty-tcnative-alpine] (https://github.com/pires/netty-tcnative-alpine)
- - Use a distribution with `glibc`
-
-If you are running inside of an embedded Tomcat runtime (e.g., Spring Boot), then some versions of `netty-tcnative-boringssl-static` will have conflicts and won't work. You must use gRPC 1.4.0 or later.
-
 Below are known to work version combinations:
 
 grpc-netty version | netty-handler version | netty-tcnative-boringssl-static version
@@ -356,6 +365,8 @@ grpc-netty version | netty-handler version | netty-tcnative-boringssl-static ver
 1.7.x-1.8.x        | 4.1.16.Final          | 2.0.6.Final
 1.9.x-             | 4.1.17.Final          | 2.0.7.Final
 
+_(grpc-netty-shaded avoids issues with keeping these versions in sync.)_
+
 ### OkHttp
 If you are using gRPC on Android devices, you are most likely using `grpc-okhttp` transport.