Add CVE-2019-38{29,36}/gnutls28

Explicitly track only the src:gnutl28 source package as the issue
affects only GnuTLS versions later than 3.5.8.

Although it needs to be checked if potentially the commit introducing
the issue was backported (but unlikely in those cases) but needs to be
further checked.

For that add a note on the respective upstream versions in the NOTEs.