Add specific note for CVE-2018-10886

This is now unfortunate because the CVE will be rejected.

> The assignment of CVE-2018-10886 is withdrawn as Apache Ant is not
> in Red Hat's scope as a CNA. The Apache project will follow up
> with MITRE.

Keep the entry complete for a (short) while to see how it evolves.