Track proposed fixes for sdl-image1.2 via stretch-pu

Two CVEs are not listed in the changelog but looks they are adressed as
well in this update. Technically one is possibly actually not-affected
as the incomplete fix was never applied. But try to be consistent here
with the already done tracking for now.