Ensure we respect available-package-patterns and available-packages directives when fetching security advisories, fixes #11704