Reference upstream commit for CVE-2018-580{0,1,2}/libraw

Note tha the upstream commit message is wrong saying "0.18.17" which is
though defitively tagged as 0.18.7 and is after 0.18.6 release, the
changelog is as well refering to 0.18.7 thus deducing that the upstream
version 0.18.7 is correct to use.