Email security reports to distribution's security contacts

Only php.net's security team was receiving security reports, making
them go unnoticed to the distribution contacts.
This patch assumes that people in the $security_developers array (other
than those in $security_distro_people) receive a copy from php.net's
security address exploder.
Add missing "global $security_distro_people"

It was missing for the change in 6d41525 to actually work.

Thanks to David Soria Parra for spotting it.
Merge branch 'pull-request/3'
Just in case we have distro folks not on security@