Expand note for CVE-2018-7263

Back in february 2018, this was tried to be clarified with MITRE.
Basically there are two CVE assignments left, and CVE-2018-7263 not
marked as duplicate of CVE-2017-11552 (but instead used the formulateion
"this might overlap with ...") because tere was no clear proof that they
are exactly the same errors. Futher it was stated "However, if there are
two different code paths by which libmad is used incorrectly, and both
code paths result in "double free or corruption" errors, then we would
represent this with two CVEs."