Add src:lua5.3 for CVE-2019-6706

It is possible that only the 5.3.x series is affected by the
use-after-free vulnerability itself thus expand the TODO comment for
further checking the issue.