hdf5 undetermined issues: add links to bug entries

Add upstream bug tracker links for a few hdf5 undetermined cves.

Upstream is actively working on theses bugs, but no fix released yet.

Information is scarce, especially since bug entries are not public,
thus not removing undetermined status for now.