refactor(secfixes-check): rewrite sec identifier check to be generic

in the future it will allow us to check against things other than CVEs

secfixes-check

@@ -223,7 +223,20 @@ local function main(arg)
 				if v:match("^%s%s%S") then
 					checkRel(v:gsub("^%s+", ""), k)
 				elseif v:match("^%s%s%s%s%S") then
-					checkCVE(v:gsub("^%s+ %- ", ""), k)
+					v = v:gsub("^%s+ %- ", "")
+					---
+					-- Split the string by whitespace, as there can be multiple security
+					-- declarations in a single line, like so:
+					--
+					-- # secfixes:
+					--   1.0.0-r0:
+					--     - CVE-2020-1000 XSA-1000 GNUTLS-SA-2020-03-01
+					---
+					for splitv in string.gmatch(v, "[^ ]+") do
+						if splitv:match("^CVE") then
+							checkCVE(v, k)
+						end
+					end
 				end
 			end
 		end