dla-needed: remove pound

I don't know exactly why pound was added to dla-needed. It was triaged
no-dsa a long while ago, and I have no reasons to believe that we should
spend more time on it.

CVE-2016-10711 is not a critical issue. It might only have an impact in
complex attacks chaining vulnerabilities in other software. The patch is
not trivial. Better alternatives exist (pound was removed from testing
quite recently, see #891248).