Add references for CVE-2019-16865/pillow

SUSE has researched the issue already and got from upstream the
information on the 4 releated pull requests. Cf.
https://bugzilla.suse.com/show_bug.cgi?id=1153191#c2 .