Security of decoy-state quantum key distribution with correlated intensity fluctuations