* Fix bug in the output of the ct_verify function

A bug in the CCA transformation was reported on the pqc-forum on 2020-12-10
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/kSUKzDNc5ME

It was fixed today in 669522db63.
This commit ports that fix to PQClean

* add note to SECURITY.md

* update upstream commit in META.yml

It seems wise to include _some_ form of guidance on what we know about
problems with certain (versions of) implementations.

[ci skip]

Uses the new Gitlab security documenting features/"standard" to explain our security non-policy.