Create a Tor-specific vulnerabilty enumeration scheme

We've been bad at reliably getting CVE numbers for stuff, but it's still useful for packages to have a "this security issue got fixed by that thing" cross reference. So let's make our own. We can even match them up to bug numbers and CVE numbers if we want: they aren't mutually exclusive.

Right now I like TROVE: Tor Registry Of Vulnerabilities and Exposures . Any objection?

If not, I am allocating TROVE-2016-001.