Mark CVE-2017-11333 as fixed with libvorbis unstable upload

The commit used by upstream is to adress CVE-2017-16433, but it adresses
at the same time CVE-2017-11333 by limiting the number of channels to
no more than 256 channels.