What are the repercussions of moving from managed beta to managed release ?
The restrictions depend on what you're talking about. For example, objects and fields can't be renamed, fields can't change data types, global classes can't be renamed, and so on. Specifics for each type of data are mentioned in Components Available in Managed Packages.
What components get frozen once you make this move ?
Again, the effects are listed in the documentation. Many elements can not be deleted by subscribers (but a few can), more types can be deleted by developers, and many types can not be deleted at all.
Can you remove custom objects / fields from a release package in subsequent versions
Yes. Once deletion is enabled, you can delete any custom fields or objects that you want. To enable deletion, follow the documentation in Deleting Components in Managed Packages.
Are there gotchas that we need to be aware of ?
The main thing is that once you delete a class, trigger, page, component, field, object, workflow rule, validation rule, etc, you can no longer create a new element of the same type with the same name. The names become permanently and irrevocably frozen, which can create all sorts of problems if you're not careful with names.
If we submit a security review of this release package at 1.1 and the customer site is at say 1.4 , how would we merge these changes ?
Once a particular version has been approved, future versions for the next year are automatically also approved through security review. As long as you're passing the annual review with the latest version, you don't have to get every new version reviewed.