libgrss: add patch for CVE-2016-20011

[risicle]

Motivation for this change

https://nvd.nist.gov/vuln/detail/CVE-2016-20011

See also #128393

Unfortunately this fix isn't yet merged upstream (https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7) which almost tempts me to bring it in-repo. Thoughts?

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• 21.11 Release Notes (or backporting 21.05 Relase notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[amaxine]

Can we just mark libgrss as unsafe and drop it as a dependency from tracker-miners (by disabling it with Dminer_rss=false)? As far as I can see, the only app to use RSS as a source is gnome-news which we do not have in nixpkgs, and it's equally unmaintained to libgrss.

I guess let's at least merge and backport this to 21.05 for now, and we can decide on just dropping it completely later.

Also, thanks for opening the PR, I completely forgot about it in the first place!

[github-actions]

Successfully created backport PR #131847 for release-21.05.