Cached host security and bugfix update counts are not refreshed after PackageUpdate security classification changes

[sr-rossanderson]

Patchman stores cached host counters such as sec_updates_count and bug_updates_count.

These are recalculated when the host's updates many-to-many relation changes.

However, errata processing can later modify PackageUpdate.security using queryset .update().

Changing a field on the related PackageUpdate object does not trigger the host M2M signal, leaving cached host counters stale even though the underlying update records are correctly classified.

Expected behaviour:

After security classification completes, host-level security and bugfix counters should reflect current PackageUpdate.security values.

Suggested fix:

Recalculate affected hosts after security classification, conceptually:

scan_package_updates_for_affected_packages()
mark_errata_security_updates(...)
refresh_host_update_counts()

Impact:

The Patchman UI can display incorrect security-patch counts even though the underlying update data is correct.