[Secure-testing-team] Introducing not-affected

[Moritz Muehlenhoff]

Hi,
now that we've a pretty complete security history back to
a few years, I'm planning to implement package specific HTML security
overviews, so that one can have a look at the security history
of a package without browsing through the whole CAN/list.

This should include cases, where Debian is not affected by 
vulnerability, so I introduced "not-affected" with the latest
CVE processing bunch. Please use it like this:
- packagename not-affected (reason)

We'll need to update the checklist script, so that it ignores
not-affected instead of a version number.

Cheers,
        Moritz