Add security advisory coverage to update status XML

Followup to #2787165: Add security advisory coverage field to projects. Blocks #2766491: Update status should indicate whether installed contributed projects receive security coverage.

Each <release> element of the XML should have a brief string, both human and machine-readable, indicating:

• Project is not covered.
• Release is not covered, it isn't a full release.
• It is a covered full release.

This section of the XML generation will have to be converted from string concatenation to SimpleXML and invoke an alter hook to make this possible.