Composer: Include metadata about the security coverage opt-in in the 'extra' attribute of composer.json files

To help inform users who are building Drupal projects purely from a command-line/composer context, we will be adding meta data about the security coverage status of projects to the 'extra' attribute of composer.json files being served from Drupal.org. Thanks to larowlan for providing an initial patch.

Production outage: No
Change affects: Drupal.org Composer Façade
Deployment schedule: week of 2017-04-17
Backout plan: revert or fix in place