tiff: version bump to address open CVEs

- Bumps version to 4.0.9. Otherwise about two dozen packages would need
  to be backported. There were no ABI/API changes between 4.0.3 and
  4.0.9, so this is OK.
- Adds a patch from Jow that addresses a macro issue (already in
  master/lede-17.01)
- Adds patches copied from Debian for CVE-2017-18013 and CVE-2017-9935
  on top.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

libs/tiff/patches/005-fix-ftell-macro.patch

@@ -0,0 +1,11 @@
+--- a/libtiff/tiffiop.h
++++ b/libtiff/tiffiop.h
+@@ -287,7 +287,7 @@ struct tiff {
+ */
+ #if defined(HAVE_FSEEKO)
+ #  define fseek(stream,offset,whence)  fseeko(stream,offset,whence)
+-#  define ftell(stream,offset,whence)  ftello(stream,offset,whence)
++#  define ftell(stream)  ftello(stream)
+ #endif
+ #endif
+ #if defined(__WIN32__) && \