GSA plans to centralize its application security program amid a broader push to ensure the government only relies on secure software.