Also split out the variants of the package because I'm sick of waiting
for random patches to be updated before I can update my unpatched
openssh.

Also make pname correspond to the attribute name.

(cherry picked from commit c99c499)

(cherry picked from commit 2b1011d)

CVE-2020-35523:
An integer overflow flaw was found in libtiff that exists in the
tif_getimage.c file. This flaw allows an attacker to inject and execute
arbitrary code when a user opens a crafted TIFF file. The highest
threat from this vulnerability is to confidentiality, integrity, as
well as system availability.

CVE-2020-35524:
A heap-based buffer overflow flaw was found in libtiff in the handling
of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF
file can lead to arbitrary code execution. The highest threat from this
vulnerability is to confidentiality, integrity, as well as system
availability.

Fixes: CVE-2020-35523, CVE-2020-35524

[20.09] glib: 2.64.5 -> 2.64.6

[20.09] libtiff: fix two security issues

This fixes CVE-2021-23336:
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/

(cherry picked from commit c63208e)

(cherry picked from commit 2e4e20f)

[staging-20.09] openssh: 8.4p1 -> 8.5p1 and mark CVE-2021-28041

[staging-20.09] python3Packages.django_2: 2.2.18 -> 2.2.19

It includes a low-severity security fix:
https://gnutls.org/security-new.html#GNUTLS-SA-2021-03-10

(cherry picked from commit a253ed2)

https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html
It's meant to be fully compatible with 3.6, so we can fast-track it.

(cherry picked from commit f688168)

[staging-20.09] popt: 1.16 -> 1.18

master commit: a24b40b; moved to staging-20.09 in 36d15c7

The jobset on Hydra is >90% complete, so let's merge to update -small.
https://hydra.nixos.org/eval/1657620