Mark CVE-2019-18898 as NFU

Somehow a special case here. The affected 'source' would be
src:trousers, but a %posttrans would even not be present in the upstream
provided 'spec' files for rpm packaging.

The CVE assignment seems specific to the packaging in SUSE itself.