transaction.security and position.security should be Security() object instead of str

[hezhao]

transaction.security and position.security currently are only assigned as str of CUSIP number, instead it should be a Security() object, so that more useful ticker symbol can also be obtained. I see that ofx.security_list already parses a list of Security() objects, it should not be difficult to create a lookup map with CUSIP as key and Security() object as value.

https://github.com/jseutter/ofxparse/blob/3236cfd96434feb6bc79a8b66f3400f18e2ad3c4/ofxparse/ofxparse.py#L644

https://github.com/jseutter/ofxparse/blob/3236cfd96434feb6bc79a8b66f3400f18e2ad3c4/ofxparse/ofxparse.py#L601

[bzbarsky]

In particular, the docs at https://github.com/jseutter/ofxparse/blob/master/README.rst already claim that this is a Security object.