Update NOT-FOR-US note for CVE-2011-2054

Originally it was planned to actually reject CVE-2011-2054 because at
some point it was misused as CVE-2011-2524. But apparently the
respective CNA decided to use it still.