Add note to UPGRADE.rst about removing riot.im from list of trusted identity servers