Support "2.6 Dependency Patching" of MSVP

[cmlh]

"2.6 Dependency Patching" of MVSP is reproduced below:

2.6 Dependency Patching

Apply security patches with a severity score of "medium" or higher, or ensure equivalent mitigations are available for all components of the application stack within one month of the patch release

The parent of this [MVSP] issue is #1151.

[cmlh]

This is out of scope of ASVS which does not verify patching.

[tghosth]

Agree