Update to the security requirements object model

The object model now includes hosted and packaged apps.