Associate CVE-2019-1503{2,3} with the original itp for it

Just in case someone comes to the idea to package it (under pydio new
upstream name) we at least have an easier view on which CVEs to
re-check.