Corrected the CPG Report security practice variable

[randywoods]

🗣 Description

The practice is supposed to display with each question in the CPG report. Its name was changed somewhere along the line and was therefore not displaying.

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

• [ ] This PR has an informative and human-readable title.
• [ ] Changes are limited to a single goal - eschew scope creep!
• [ ] All future TODOs are captured in issues, which are referenced in code comments.
• [ ] All relevant type-of-change labels have been added.
• [ ] I have read the CONTRIBUTING document.
• [ ] These code changes follow cisagov code standards.
• [ ] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• [ ] Tests have been added and/or modified to cover the changes in this PR.
• [ ] All new and existing tests pass.

✅ Pre-merge checklist

• [ ] Revert dependencies to default branches.
• [ ] Finalize version.

✅ Post-merge checklist

• [ ] Create a release.