Set affected version by module

Github security advisory best practice for affected version is to use one version range per product (per module) (see https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/best-practices-for-writing-repository-security-advisories#affected-versions). We should probably do the same, especially if we want to have synchronization of data (see SPAPP-4).