CVE-2018-17234/hdf5: add bug entry and commit

Upstream bug tracker entry not public, can't view it myself. Adding
link to the tracker in case it becomes public in the future.

Access to upstream bitbucket also behind login portal, but does not
require privileged account.