Fix progress

Each product is counted once, by the less resolved of its two CVE statuses. For example, "Fix" for one CVE and "Investigation" for the other counts as under investigation. Still open means vulnerable, workaround only, under investigation, or no status yet. The history is rebuilt from the NCSC-NL changelog. The list only covers products someone has added to it, so a rise in the total means the list grew, not that more products became vulnerable. Unofficial; accuracy not guaranteed.