Document why the text codecs are not SecurityCritical

The codecs have no upstream, so there is no DownloadLocation, which
qtattributionsscanner requires for SecurityCritical packages.

Also use the Description key consistently, instead of relying on JSON
dropping previous keys with same name.

Pick-to: 6.12
Change-Id: I1c604e430e1e625b4d09f28bb8dd2421ca1f9569
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>