Compute all CVEs for updates

[martincostello]

Is your feature request related to a problem?

If a .NET SDK update occurs when is more than one version (e.g. #320), then any CVEs that are fixed are only reported for those in the version being updated to, rather than also including any from the releases between the old one and the new one.

Describe the solution you'd like

Include all fixed CVEs by the update in the PR description.

Describe alternatives you've considered

None.

Additional context

This also has the effect that if there's an update from version N to version N+2 where version N+1 fixed a CVE and N+2 did not that the update will be reported as a security update correctly. Currently the update would not flag as an security update as the delta between the releases is not computed.