Track some more CVE fixes for src:linux with stretch-pu upload

One CVE was fixed already in the 4.9.185-1 upload (back then no CVE
assigned) and three more in versions between 4.9.185 and 4.9.189 as
uploaded and thus included as well in 4.9.189-1.