Track fixed versions for radare2 up to 3.9.0 upstream

Note one is actually only fixed in the followup 3.9.0 completely, see
notes in the security tracker which otherwise would have made the fix
incomplete and opening a new CVE.