tiff: version bump to address open CVEs

- Bumps version to 4.0.9. Otherwise about two dozen packages would need
  to be backported. There were no ABI/API changes between 4.0.3 and
  4.0.9, so this is OK.
- Adds a patch from Jow that addresses a macro issue (already in
  master/lede-17.01)
- Adds patches copied from Debian for CVE-2017-18013 and CVE-2017-9935
  on top.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

libs/tiff/patches/001-autoconf-compat.patch

@@ -9,9 +9,9 @@
  ACLOCAL_AMFLAGS = -I m4
  
  docfiles = \
-@@ -48,7 +48,7 @@ EXTRA_DIST = \
- 
- dist_doc_DATA = $(docfiles)
+@@ -61,7 +61,7 @@ distcheck-hook:
+ 	rm -rf $(distdir)/_build/cmake
+ 	rm -rf $(distdir)/_inst/cmake
  
 -SUBDIRS = port libtiff tools build contrib test man html
 +SUBDIRS = port libtiff tools build contrib