Add CVE-2018-17187/qpid-proton

The source is thus present in older suites and in the stable release.

If the source is present but proton-j does not land in any of the
produced binary packages this can be markded as unimportant severity.