Log Message:
Make the PKGVULNDIR variable more generic, so one can choose where to
store the vulnerabilities file.  This variable was already recognized by
audit-packages but not by bsd.pkg.mk which hardcoded DISTDIR.