Add additional comment for CVE-2019-14271/docker.io

We need to check if our package in buster already meets the condidtion
making this a problematic issue, otherwise it's just no-dsa.