Add missing NEWS entry, update UPGRADING

This was done back in January, but never noted in the NEWS file.
References:

php#2312
php#2321

Author: narfbg

NEWS

@@ -235,6 +235,8 @@ PHP                                                                        NEWS
   . Fixed bug #73961 (environmental build dependency in hash sha3 source).
     (krakjoe)
   . Changed HashContext from resource to object. (Rouven Weßling, Sara)
+  . Disallowed usage of non-cryptographic hash functions with HMAC and PBKDF2.
+    (Andrey Andreev, Nikita)
 
 - intl:
   . Fixed bug #74433 (wrong reflection for Normalizer methods). (villfa)

UPGRADING

@@ -49,8 +49,8 @@ PHP 7.2 UPGRADE NOTES
     example `bcmod('4', '3.5')` now returns '0.5' instead of '1'.
 
 - Hash:
-  . The hash_hmac(), hash_hmac_file() and hash_pbkdf2() functions no longer
-    accept non-cryptographic hashes.
+  . The hash_hmac(), hash_hmac_file(), hash_pbkdf2() and hash_init() (with
+    HASH_HMAC) functions no longer accept non-cryptographic hashes.
 
 - JSON
   . The json_decode() option JSON_OBJECT_AS_ARRAY is used if the second