Add previous reference for cpio bug for CVE-2019-14866

The issue was initially reported to the Debian BTS as well, tagged
security but without requesting a CVE. This was now done by Red Hat so
associate both items.