Add new libspring-java issues CVE-2018-127{0,1,2}

CVE-2018-1271 is not marked this time as <unfixed> (unimportant) since
the issue is very specific when static resources are served from a file
system on Windows.