Add CVE-2019-12175/bro (and respective fixed version)

The CVEs for Zeek Network Security Monitor might need careful
investigation in future and montitor for a src:zeek package. For now at
time of wrinting the commit message, in Debian the respective source
package is still named src:bro.