Reference patches for CVE-2017-837{2,3,4}

Unfortunately libmad does not have a VCS yet were it is maintained, so
need to reference the patches as they were added in the respective
source package.

libmad-0.15.1b/debian/patches/length-check.patch adresses CVE-2017-8374,
whereas libmad-0.15.1b/debian/patches/md_size.diff adresses
CVE-2017-8372 and CVE-2017-8373.