rojig: mark rojigRPM as security update if a new member RPM is a security update

[jlebon]

This is a musing that came up while discussing #247. If one of the new RPMs (relative to the previous commit) in the jigdo set is a security update, then the jigdo RPM itself should be marked as a security update. This is more of a releng integration issue rather than something we can do at the rpm-ostree compose level.