Describe required format for for PLATFORM_SECURITY_PATCH

Hardware-backed keystore attestation and version binding rely on
PLATFORM_SECURITY_PATCH having the format YYYY-MM-DD.

Bug: 22914603
Change-Id: If116e3ca5611920021b098d6b610ae609956aa5c
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 143f25f..beff197 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -110,7 +110,7 @@
 
 ifeq "" "$(PLATFORM_SECURITY_PATCH)"
   # Used to indicate the security patch that has been applied to the device.
-  # Can be an arbitrary string, but must be a single word.
+  # Must be of the form "YYYY-MM-DD" on production devices.
   #
   # If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
   PLATFORM_SECURITY_PATCH := 2016-05-01