This will add the
tag:security label if any of the commits has
security upgrade to in the title, we do not in any way attempt to remove
tag:security as it is a very sensitive label.
More conditions (
fixes CVE in description ?) under which
tag:security is added can be introduced but this one is a good start.