Change @todo comment in core/modules/update/src/ProjectSecurityData.php to point to a better issue

Problem/Motivation

#2991207: Drupal core should inform the user of the security coverage for the site's installed minor version including final 8.x LTS releases was committed to 9.0.x and 8.9.x with the following code comment:

   * @todo In https://www.drupal.org/node/2608062 determine how we will know
   *    what the final minor release of a particular major version will be. This
   *    method should not return a version beyond that minor.

#2608062: [META] Requirements for tagging Drupal 9.0.0-alpha1 is the meta for tracking 9.0.0-alpha1 requirements, and is now closed (fixed).

As @Gábor Hojtsy pointed out at #2991207-249: Drupal core should inform the user of the security coverage for the site's installed minor version including final 8.x LTS releases.3, we need a better place to point this @todo.

Proposed resolution

Fix the comment so it points to #2998285: Add information on later releases to updates.drupal.org instead.

Remaining tasks

1. Find or create the right issue for this.
2. Update the comment.
3. Review
4. RTBC
5. Commit and cherry-pick to all of 9.0.x, 8.9.x and 8.8.x branches

User interface changes

None.

API changes

None.

Data model changes

None.

Release notes snippet

None.