Add more CVEs for nextcloud-server

There seem to be two nextcloud related ITP's one naming for
src:nextcloud and one for src:nextcloud-server. Are those distinct,
which CVEs need to be re-evaluated?