Log Message:
Store vulnerabilities file in ${PKGVULNDIR} instead of ${DISTDIR}, in case
the latter is not appropriate.  The former defaults to the latter.
Bump version to 1.12.  Per discussion with Alistair Crooks.