Add todo for CVE-2018-1067

It is unclear where the issue lies and the Red Hat report does not share
much information. It is known that the CVE CVE-2018-1067 is for an
incomplete fix for CVE-2016-4993. The CVE-2016-4993 is unspecific to
directly an issue in undertow but rather seem to indicate the issue is
in (its use) in WildFly.

This needs more clarification and either mark both as NFU, both
associated with src:undertow with appropriate state (depending on if the
incomplete fix was applied in any Debian released version).

Futher is to check with the maintainer if undertow might just be removed
from Debian.