Add notes on qemu mitigation needed as part for CVE-2018-3639

Note, we explicitly do not track the source package as vulnerable,
because it is not, but fixes are required to enable the mitigation for
quests and protect them against CVE-2018-3639.