Expirable bugs in security-signoff

Incomplete bug reports can expire if they are unattended and are inactive. These bugs are not confirmed, or in a status that indicates they were confirmed. An Incomplete bug can remain in this list indefinitely, so long as the bug is regularly updated. See Bugs/Expiry.