Add CVE-2019-17571/apache-log4j1.2

Note there are explicitly two different CVEs here, one is CVE-2017-5645
which was associated with the 2.x branch on Log4j and CVE-2019-17571
with the 1.2.x branch (wich is end-of-life upstream already).