Fix security requirements diagram to include hosted & packaged apps

The object model now includes hosted and packaged apps.