The effort to create informative labels to give buyers insight into the cybersecurity of connected devices continues to advance — but very slowly, according to technology firms and the US government.