xz: Apply patch to solve security fix (ZDI-CAN-16587)

xz: Apply patch to solve security fix (ZDI-CAN-16587)

- Malicious filenames can make xzgrep to write to arbitrary files
   or (with a GNU sed extension) lead to arbitrary code execution.
- xzgrep from XZ Utils versions up to and including 5.2.5 are
   affected. 5.3.1alpha and 5.3.2alpha are affected as well.
- This bug was inherited from gzip's zgrep. gzip 1.12 includes
   a fix for zgrep.
- CU167 has gzip-1.12 with the fix already merged.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>