Add CVE-2019-1248{1,2,3} and start tracking with src:gpac

Mark as undetermined as nearer details are not clarified yet. The issue
seem to be reported against v0.7.1 at least.

https://github.com/gpac/gpac/issues/1249