Add `reason` field to Fixes in Statement structure

[copernico]

This will allow us to keep the general notes field for text that concerns the vulnerability itself, whereas information about where and how the fix commits were found can be kept in the new field.