Track version with fixed version for CVE-2017-1000159/atril

We want to track the first version entering unstable. The issue got
fixed in 1.20.0 upstream, and 1.20.0-1 was the first version of atril
entering unstable with the fix (no preivous version with applying
separate patch, unless wrongy triaged).