Update cpe for vulnerability scanners

Bug: http://b/201572953
Change-Id: Id51ecc4caa8da24ad7824f1111920511a97492b4
diff --git a/METADATA b/METADATA
index d97975c..0276872 100644
--- a/METADATA
+++ b/METADATA
@@ -1,3 +1,6 @@
 third_party {
   license_type: NOTICE
+  security {
+      tag: "NVD-CPE2.3:cpe:/a:apache:xalan-java:2.7.1"
+  }
 }