Email security reports to distribution's security contacts

Only php.net's security team was receiving security reports, making them go unnoticed to the distribution contacts.
This patch assumes that people in the $security_developers array (other than those in  $security_distro_people) receive a copy from php.net's security address exploder.

To be reviewed by pajoye or somebody else.