Loosen security reviewer task matching criteria

While it's valid for a task list item to start with an asterisk instead of a hyphen, we weren't checking for that when validating that a security merge request has been reviewed.