manifest: Add the `security-risk` attribute

In addition to adding the `security-risk` attribute, update TPIP script
to check if all the dependencies contains this attribute.

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>