Collect apache project's machine readable advisories.

In any case we want to avoid parsing human readable advisories, so to break https://github.com/nexB/vulnerablecode/issues/100 in smaller manageable parts , we should always parse machine readable advisories if possible.

Apache projects maintain machine readable security advisories at a project level. See for example

https://github.com/apache/syncope/blob/fa82b8266c0c664c49d010d397a9ffb3f6ab4555/src/site/xdoc/security.xml
https://github.com/apache/ofbiz-site/blob/8a3e9fb778858257fd1b930e51059f5a61d2457a/template/page/security.tpl.php
https://github.com/search?q=org%3Aapache+cve&type=code