Add note for origin of the issue for CVE-2018-16588

The patch which has the problem was taken from a upstream pull request
at https://github.com/shadow-maint/shadow/pull/2 where a first iteration
hat the issue. Upstream code never had the issue in consequence at it
was not merged at that stage yet.