Add fixed version for CVE-2019-19271/proftpd-dfsg

The issue was fixed in 1.3.6 (and verified between 1.3.5e-1 and 1.3.6-1
versions in Debian).

As such the fix is as well already present in buster, thus removing the
no-dsa tagged entry.