Finding a software flaw is easy to celebrate. Getting it fixed is the harder business Veracode has spent two decades learning to sell.