Record assigned CVEs for drupal an SA-CORE-2018-001

Queried the Drupal security team, and the CVEs were yet pending. Record
now the assigned CVEs and update cross references.

Additionally track the issues for Drupal 8 still with the itp. Gunnar
Wolf though makes clear in https://bugs.debian.org/756305 that packaging
Drupal 8 for Debian should not be done.