Add new hdf5 with undetermined status

As with previous reports from SegfaultMasters it is here sufficiently
clear that the issues are associated with src:hdf5, so track those. But
not yet as <unfixed> as it is as well here not clear if the reports were
just trown in on github and CVEs requested without making upstream aware
of the issues.

keep as well TODO check item as we defintively only started tracking the
source package here.