libtiff: 2018-11-04 -> 4.0.10

[andrew-d]

Motivation for this change

Security updates (#49786)

This is a followup to #49860 that switches back to a released version, and updates to 4.0.10 to fix CVE-2018-18661. The Debian patchset that we applied prior to #49860 (link) doesn't contain any security updates or bugfixes (just a typo fix, see here), so I didn't re-add those.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.

---

cc @ckauhaus

[Ekleog]

Could you rebase this against staging-next? The RFC states that mass-rebuild security fixes should go there, to reduce its time-to-upstream :)

[Ekleog]

Actually nevermind, I've cherry-picked your commit to both staging-next and release-18.09. But next time it'd be convenient if the PR was done against staging-next for security fixes (staging is for regular mass-rebuilds) with a PR including a backport to release-18.09 using git cherry-pick -x.

Anyway, thank you for your reactivity in handling this update!

Cherry-pick commits: ac3b358 and 6ea49f6.