Email security reports to distribution's security contacts

Only php.net's security team was receiving security reports, making
them go unnoticed to the distribution contacts.
This patch assumes that people in the $security_developers array (other
than those in $security_distro_people) receive a copy from php.net's
security address exploder.

include/functions.php

@@ -1356,6 +1356,9 @@ function get_package_mail($package_name, $bug_id = false, $bug_type = 'Bug')
 	} else if ($bug_type == 'Security') {
 		// Security problems *always* go to the sec team
 		$to[] = $secBugEmail;
+		foreach ($security_distro_people as $user) {
+		    $to[] = "${user}@php.net";
+		}
 		$params = '-f bounce-no-user@php.net';
 	}
 	else {