djvulibre: patching multiple CVEs

[d-goldin]

Motivation for this change

Addresses:

#73624
#70086

19.09: #74876
19.03: #74877

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Notify maintainers

cc @ckauhaus @Anton-Latukha

[ckauhaus]

So many locally added patches... is there a way to use fetchpatch from online resources? /me in the fear of nixpkgs tree bloat...

[d-goldin]

@ckauhaus: I would have preferred that too, but with sourceforge I did not see a way to do that. But I can check again.

[d-goldin]

There might be also some other issues with this. I ran a nix-review build on the 19.09 PR:

[16/444/549 built (4 failed), 2913 copied (19276.7/19287.7 MiB), 7082.3 MiB DL] building birdfont-2.27.0 (buildPhase): build/libbirdfont/PenTool.c: In function �cannot build derivation '/nix/store/4jf3qxpwn5qnkf8dwhca2x3mrq5b96zm-env.drv': 4 dependencies couldn't be built
[548 built (4 failed), 2913 copied (19276.7 MiB), 7082.3 MiB DL]
error: build of '/nix/store/4jf3qxpwn5qnkf8dwhca2x3mrq5b96zm-env.drv' failed
https://github.com/NixOS/nixpkgs/pull/74876
4 package failed to build:
gscan2pdf k3d octaveHg winswitch

k3d, octaveHg and winswitch are unrelated, but gscan2pdf seems to be related.
So I'll briefly look into that.

[d-goldin]

Alright, seems like gscan2pdf is fine, just that the test-suite is a bit load/timing sensitive and with high system load during nix-review not enough iterations of some tests could happen within desired timespan.

[ckauhaus]

• Confirm djvulibre build on NixOS and Darwin
• Confirm gscan2pdf build on NixOS

[ckauhaus]

Confirm gscan2pdf build on NixOS and Darwin

[ckauhaus]

@d-goldin Merged to staging, but GitHub didn't recognise the fact for some reason. This branch can be deleted.