Update rebase templates

The legacy rebase template should not mention base-browser.

On the other hand, moving security backport commits just after the other upstream bugs, per @pierov's comment seems worth mentioning in all 3.