Update a hyperlink in security.md

Fix a hyper link of 'attachment_fu' plugin.
It prevent merging the URL and semicolon.