Ignore data/CVE/list.old (used by bts-update)

The automatic update triggers a run of bts-update list, which needs a
data/CVE/list.old in place. We should ignore this file to avoid that
it's accidentially commited.