Track issue for CVE-2018-8977 (although only affects experimental)

Purpose is that we do not let exiv2 0.26 without fixes go to unstable
and thus possibly next stable release.